itsourcecode Leave Management CVE-2026-103543

Requires an authenticated low-privilege session (CVSS PR:L) on an itsourcecode Leave Management System 1.0 instance; the attacker then supplies a malicious LEAVTID argument to /module/leavetype/controller.php to trigger the SQL injection. Exploitation is remote and low-complexity with no user interaction, and a public PoC exists. The primary limiting factors are the authentication requirement and the product's rarity - it is a free sample/hobby PHP application with negligible production deployment, so realistic exposure is minimal.

This is a high-CVSS-irrelevant / genuinely-low-real-risk issue despite being a SQL injection (CWE-74, effectively CWE-89). The signals are consistent and point to low priority: the VulDB-assigned CVSS 4.0 base score is only 2.1 (AV:N/AC:L/PR:L/UI:N) with all impacts rated Low (VC:L/VI:L/VA:L), and the E:P (Proof-of-Concept) exploit-maturity metric reflects that exploit code was disclosed but no weaponization or active use is reported. There is no EPSS score, no CISA KEV listing, and no indication of active exploitation. The CVSS vector is PR:L, so exploitation requires an authenticated low-privilege user - the attack is remote (AV:N) and low-complexity, but gated behind a valid session. Note a tension worth flagging: the vendor rated all three impact dimensions only Low, whereas a classic SQL injection in an application module typically yields high confidentiality/integrity impact (database read/write); VulDB's conservative Low ratings likely reflect limited scope or uncertainty rather than a technical limit, so a defender could reasonably treat the true impact as higher than 2.1 suggests. The dominant mitigating factor is prevalence: itsourcecode Leave Management System is a free hobby/source-code-download PHP project with essentially no enterprise production footprint. Overall, real-world risk is low - public PoC exists but the product is rarely deployed and authentication is required.

An authenticated low-privilege user of an itsourcecode Leave Management System 1.0 deployment sends a crafted value in the LEAVTID argument to /module/leavetype/controller.php, injecting SQL that the application concatenates into a database query. This lets the attacker read or alter back-end database records (e.g., leave records, user data). A public proof-of-concept is already disclosed in the referenced GitHub issue, lowering the skill needed to reproduce it.