CodeAstro Leave Management CVE-2026-15558

Exploitation requires the attacker to hold an authenticated session with low-privilege access to the application's admin panel (/admin/ path), as confirmed by the CVSS 4.0 PR:L metric. The vulnerable endpoint /SimpleOnlineLeave/admin/deletemp.php must be reachable over the network. No special non-default configuration is required beyond a standard installation of CodeAstro Simple Online Leave Management System 1.0. Exploitation is limited by the authentication prerequisite - unauthenticated external attackers cannot exploit this directly without first obtaining valid admin credentials through phishing, credential stuffing, or another vulnerability. The application must also be internet-facing or reachable from the attacker's network segment for remote exploitation.

The CVSS 4.0 base score of 2.1 is notably low for a SQL injection vulnerability, primarily driven by the PR:L (low privilege) requirement and the low-impact ratings across VC:L/VI:L/VA:L with no scope change to subsequent systems. The E:P supplemental metric confirms a public proof-of-concept exists, which elevates practical risk beyond the base score alone. No CISA KEV listing is present, and no EPSS data was provided, so widespread automated exploitation is not confirmed. The admin-path location of the vulnerable endpoint implies the attacker must already hold some authenticated session in the application's admin panel - this is a meaningful limiting factor. In practice, this represents a real but bounded risk: an insider or compromised admin account could leverage this to enumerate or tamper with database records. The low CVSS score aligns with the niche deployment footprint and limited blast radius, but the existence of a public POC makes patching or hardening urgent for any active deployments.

An attacker who has obtained or guessed low-privilege admin credentials for the Leave Management System navigates to /SimpleOnlineLeave/admin/deletemp.php and submits a crafted HTTP request with a SQL injection payload in the 'ID' parameter (e.g., ID=1 OR 1=1--). Because the parameter is concatenated unsanitized into a backend SQL query, the attacker can enumerate table contents, extract employee records, or modify leave data. A public proof-of-concept on GitHub documents this technique, lowering the bar for exploitation significantly.