Leave Management System CVE-2026-11507

Exploitation requires the attacker to hold a valid low-privilege authenticated session within the CodeAstro Leave Management System (CVSS PR:L confirmed). The vulnerable endpoint /admin/delete_leave_type.php must be reachable - if standard low-privilege users are blocked from /admin/ routes by authorization middleware, the attack surface is limited to users with admin-level access (PR:H scenario). No additional attack prerequisites such as race conditions, specific OS, or non-default configuration are required (AT:N, AC:L). Exploitation is limited by the authentication requirement, and by the impact scope being confined to the application's own database (SC:N - no scope change to other system components). The vulnerability does not affect systems where the leave_type parameter undergoes server-side input validation or where the application uses parameterized queries.

Despite the network-accessible (AV:N), low-complexity (AC:L), no-additional-requirement (AT:N) nature of this vulnerability, the overall CVSS 4.0 score of 2.1 is low because impact is bounded: VC:L/VI:L/VA:L with SC:N/SI:N/SA:N indicates only partial data exposure/modification within the application database, with no cascading impact to other system components. PR:L requires the attacker to hold at least a low-privilege account before exploitation. EPSS data was not provided in the source intelligence; no CISA KEV listing exists, suggesting no confirmed mass or in-the-wild exploitation at time of analysis. The E:P modifier confirms a public PoC exists, which elevates the realistic exploitation likelihood above theoretical. The combination of low CVSS impact scores and the absence of KEV suggests this is a moderate operational priority - real but limited in blast radius - particularly for organizations exposing the leave management system to the internet or internal untrusted users.

An authenticated user with a low-privilege account (such as a standard employee in the leave management system) submits a crafted HTTP GET or POST request to /admin/delete_leave_type.php with a manipulated leave_type parameter containing SQL injection syntax (e.g., leave_type=1 OR 1=1--). The unsanitized input is incorporated into the backend SQL query, allowing the attacker to enumerate, extract, or modify records in the application database. A public proof-of-concept is available at https://github.com/jimages/PoC/issues/2, lowering the skill barrier for exploitation.