Simple Online Leave Management System CVE-2026-15559

Exploitation requires possession of a valid low-privilege user account on the CodeAstro Simple Online Leave Management System - the CVSS 4.0 vector PR:L explicitly confirms authentication is mandatory, and unauthenticated exploitation is not supported by available data. The vulnerable endpoint /SimpleOnlineLeave/admin/accept.php must be network-reachable (AV:N), meaning the application must be exposed to the attacker's network, either publicly on the internet or internally. No special non-default configuration is required beyond a standard installation of version 1.0. Exploitation is limited by: (1) the authentication prerequisite - an attacker must first acquire valid credentials; (2) the application's niche deployment scope, reducing the probability of encountering it; and (3) impact bounded to the leave management database rather than the underlying operating system.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects a constrained risk profile. PR:L confirms that a valid low-privilege account is required, ruling out unauthenticated exploitation - this is the primary limiting factor for mass exploitation. Attack complexity is low (AC:L) with no special attack conditions (AT:N), meaning that once credentials are obtained, exploitation is straightforward. All three impact metrics for the vulnerable system are rated Low (VC:L/VI:L/VA:L), consistent with typical read/write access to the leave management database rather than full system compromise. No subsequent-system impact is indicated (SC:N/SI:N/SA:N). The E:P evidence tag and the referenced GitHub PoC lower the skill threshold significantly, elevating practical risk above the raw numeric score might suggest for defenders who can verify credential exposure. The absence of a CISA KEV listing means confirmed in-the-wild exploitation has not been reported to CISA; the product's narrow deployment footprint further limits overall blast radius.

An attacker who has obtained low-privilege credentials to the leave management system - via phishing, credential stuffing, or insider access - submits a crafted HTTP POST request to /SimpleOnlineLeave/admin/accept.php with a SQL injection payload in the appid field, such as a UNION-based or boolean-based injection string. A public exploit demonstrating this technique is available at https://github.com/sl1der-fr0g/Findings/issues/3, enabling even low-skill threat actors to reproduce the attack. Successful exploitation could yield extraction of the full leave management database, including employee names, leave records, and potentially credential hashes stored therein.