EUVD-2026-43265
GHSA-v2qc-523v-6whm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible admin endpoint requiring low-privilege authentication (PR:L); no scope change; limited impact across all three pillars consistent with constrained DB user permissions.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/dashboard.php. This manipulation of the argument Name causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
SQL injection in CodeAstro Simple Online Leave Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter within /SimpleOnlineLeave/admin/dashboard.php to inject arbitrary SQL commands against the backend database. A public proof-of-concept exploit is confirmed via a GitHub issue reference, elevating real-world risk above the moderate CVSS 4.0 base score of 5.3. The CVE is not currently listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation, but the low attack complexity combined with an available POC makes this a credible near-term threat for any internet-exposed deployment.
Technical ContextAI
The vulnerability is a classic CWE-89 (SQL Injection) flaw in a PHP-based leave management web application. The affected endpoint /SimpleOnlineLeave/admin/dashboard.php passes user-supplied input from the Name argument directly into a database query without adequate sanitization or parameterized query enforcement. The CPE cpe:2.3:a:codeastro:simple_online_leave_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating all known releases of the CodeAstro application are within scope. As a typical PHP application likely backed by MySQL or MariaDB on a LAMP-style stack, SQL injection at this endpoint can expose the full database to read operations (UNION-based data exfiltration), write operations (INSERT/UPDATE/DELETE), or - depending on database user privileges - file system interaction via LOAD_FILE or INTO OUTFILE. The admin dashboard context makes this endpoint high-value: it likely holds employee records, credentials, and session data.
RemediationAI
No vendor-released patch has been identified at time of analysis; organizations should monitor the CodeAstro vendor site at https://codeastro.com/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-15523 for patch or updated release availability. As an immediate compensating control, restrict network access to /SimpleOnlineLeave/admin/dashboard.php using web server ACLs or a WAF to trusted IP ranges only - this reduces remote exploitation risk but may require VPN infrastructure for remote admins. Deploy WAF rules targeting SQL injection patterns on the Name parameter specifically; note that overly broad WAF rules may cause false positives on legitimate name-field input containing apostrophes or special characters. Enforce least-privilege database account permissions for the application's DB connection so that a successful injection yields limited access - for example, revoke FILE, DROP, and GRANT privileges from the application DB user. Implement or enforce strong authentication on all admin accounts to raise the barrier posed by the PR:L requirement. If the admin interface has no legitimate internet-facing business need, block external access at the perimeter firewall immediately as the highest-impact interim control.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today