EUVD-2025-201694Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network exploitable with low complexity, no privileges, no interaction; low impact on all CIA dimensions.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability has been found in code-projects Simple Leave Manager 1.0. Affected by this vulnerability is an unknown functionality of the file /request.php. Such manipulation of the argument staff_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in Simple Leave Manager 1.0 allows remote attackers to manipulate the staff_id parameter in /request.php to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. A public exploit is available but no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
The vulnerability exists in a PHP web application, Simple Leave Manager, which processes leave requests. The file /request.php handles staff-related data, and the staff_id parameter is directly inserted into SQL queries without proper sanitization or parameterization, leading to an injection (CWE-74). The affected product is identified by CPE cpe:2.3:a:carmelo:simple_leave_manager:1.0.
RemediationAI
No vendor-released patch is available. As immediate mitigation, implement parameterized queries or input validation for the staff_id parameter in /request.php. Deploy a web application firewall (WAF) rule to block SQL injection patterns targeting this parameter. Restrict access to /request.php by IP whitelisting if feasible. Review database permissions for the application's database user to enforce least privilege. The absence of an official fix means an upgrade to any future patched version should be prioritized when released, but no advisory or release date exists.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today