CodeAstro Leave Management System CVE-2026-11508

The attacker must possess a valid low-privilege account with access to the admin panel (confirmed by PR:L in the CVSS 4.0 vector) - unauthenticated external users cannot trigger this vulnerability without first obtaining credentials. The vulnerable endpoint /admin/search_staff_to_assign_pc.php must be reachable over the network (AV:N), which is the default deployment posture for this web application. No special non-default configuration or feature flag is required beyond the application being deployed and accessible. Exploitation is bounded by the authentication prerequisite and the low CIA impact ceiling (VC:L/VI:L/VA:L), suggesting partial data exposure rather than full database takeover. No specific platform or OS restriction was noted in the available data.

The CVSS 4.0 score of 2.1 is low primarily because of PR:L (low-privilege authentication required), which gates the attack behind a valid account, and because all system impact metrics are capped at Low (VC:L/VI:L/VA:L) with no scope change (SC:N/SI:N/SA:N). The network vector (AV:N) and low attack complexity (AC:L/AT:N) indicate the exploit is remotely executable without special conditions once authenticated. The exploit maturity modifier E:P (proof of concept) is reflected in the publicly available GitHub POC, which slightly elevates practical risk above what the score alone implies. EPSS data was not included in the provided input and cannot be cited. KEV status is absent, confirming no CISA-confirmed active exploitation at time of analysis. In practice, this is a low-to-medium real-world priority: the authentication barrier meaningfully reduces exposure, and the low CIA impact suggests partial rather than full database compromise. However, organizations deploying this system for HR or payroll-adjacent data should treat it with elevated urgency given the public POC lowering the exploitation barrier.

An attacker with a low-privilege account on the admin panel crafts an HTTP request to /admin/search_staff_to_assign_pc.php?Name=' OR 1=1-- or a similar payload, injecting SQL syntax into the unsanitized Name parameter. The injected query executes against the backend database, potentially returning all staff records or enabling blind enumeration of the database schema. A public proof-of-concept is available at https://github.com/Andelstander/cve/issues/6, meaning the attack technique requires minimal attacker skill once credentials are obtained.