EUVD-2026-42490
GHSA-2gh3-7wvm-vg2q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated login form, no interaction needed; C/I/A limited to partial database access consistent with a low-privilege DB account.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
SQL injection in CodeAstro Simple Online Leave Management System 1.0 exposes the backend database to unauthenticated remote attackers through the email parameter at /SimpleOnlineLeave/index.php. Manipulation of this parameter allows an attacker to alter SQL query logic, enabling authentication bypass, database enumeration, and data modification without any credentials or user interaction. A public proof-of-concept exploit has been disclosed via GitHub, significantly lowering the skill barrier for exploitation; the vulnerability is not currently listed in the CISA KEV catalog.
Technical ContextAI
The affected component is /SimpleOnlineLeave/index.php in CodeAstro's Simple Online Leave Management System 1.0, a PHP-based web application targeting organizational HR workflows. The root cause is CWE-74 (Injection), specifically classic SQL injection (CWE-89), arising when the email parameter is concatenated unsanitized into a backend SQL query rather than processed through parameterized statements or prepared queries. PHP applications that build SQL dynamically from request input without escaping are a textbook source of this flaw class. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the vulnerable endpoint is reachable over the network with no elevated privileges, no special attack conditions, and no user interaction required, consistent with a publicly exposed login or input form. No CPE string was provided in the available data; vendor context is at https://codeastro.com/.
RemediationAI
No vendor-confirmed patched version has been identified from the available references at time of analysis - the vendor site at https://codeastro.com/ should be monitored for an updated release. The correct long-term fix is replacing dynamic SQL string concatenation in /SimpleOnlineLeave/index.php with parameterized queries or prepared statements for all database interactions involving the email parameter. As an immediate compensating control, deploying a web application firewall (WAF) rule to block SQL injection patterns (e.g., quote characters, SQL keywords) on the email parameter of the vulnerable endpoint will reduce exposure, with the trade-off of potential false positives on legitimate email inputs. Restricting network access to the application to known trusted IP ranges eliminates remote exploitation entirely but may not be feasible for internet-facing deployments. The GitHub proof-of-concept at https://github.com/yihaofuweng/cve/issues/71 provides technical detail useful for validating WAF rule effectiveness. Ensure the underlying database account used by the application follows least privilege - read-only access where write is not required limits damage even if injection succeeds.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today