EUVD-2026-83652
GHSA-8869-544m-r67r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to application (PR:L)
-
ExploitSend crafted DEPTID to department/controller.php
-
ExecutionInjected SQL executes in query
-
ImpactExtract database contents incl. credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session to the itsourcecode Leave Management System 1.0 web application (CVSS PR:L), from which the attacker reaches /module/department/controller.php and manipulates the DEPTID argument. No user interaction and no special non-default configuration is needed beyond the department module being accessible; exploitation is limited primarily by the need for valid application credentials and by the product's tiny real-world deployment. A public POC removes the technical barrier to weaponization. |
| Impact | This is a classic high-volume, low-real-priority SQL injection disclosure. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with a modest 5.3 score reflects network reachability and low complexity but requires authentication (PR:L) and rates each impact as Low (VC:L/VI:L/VA:L) - VulDB tends to score these itsourcecode disclosures conservatively. The E:P (Proof-of-Concept) exploit maturity is corroborated by a publicly available exploit (GitHub issue), so 'publicly available exploit code exists' - but this is distinct from active exploitation: there is NO CISA KEV listing and NO EPSS score provided. Realistically the technical impact of a reachable SQLi is understated: single-parameter injection typically enables full database extraction (credential hashes), so confidentiality impact is arguably High rather than Low. The dominant risk-limiting factor is not the vuln class but the target: itsourcecode Leave Management System is a hobbyist/tutorial PHP application with negligible production deployment. Missing signals: no EPSS probability, no independent CVSS from NVD, no vendor advisory or patch - all reporting traces to a single source (VulDB) plus one POC. |
| Exploit ScenarioDerived | An authenticated low-privileged user (or an attacker who has obtained any valid application account) sends a crafted request to /module/department/controller.php with a malicious DEPTID value, injecting SQL into the department query. A public proof-of-concept exists on GitHub, lowering the skill barrier; the attacker uses UNION/boolean/time-based techniques to enumerate and dump database contents, including user credential hashes. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated user to manipulate the DEPTID argument of /module/department/controller.php and inject arbitrary SQL into the application's backend queries. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the primary impact is high confidentiality loss with limited integrity effect, and exploitation requires a valid application session (PR:L) - no user interaction or non-default configuration is needed beyond the department module being reachable. Publicly available exploit code exists (a public proof-of-concept is referenced at github.com/VivianQYW/cve/issues/2 and the VulDB entry 407922), so the technical barrier to weaponization is low, though real-world risk is tempered by the product's very small deployment footprint; there is no indication of confirmed active exploitation (CISA KEV).
RemediationAI
No vendor-released patch identified at time of analysis, and the CPE data carries a wildcard version field, so there is no confirmed fixed release to upgrade to; administrators should check https://itsourcecode.com/ and the VulDB advisory at https://vuldb.com/vuln/407922 for a vendor update before assuming one exists. Where the codebase can be modified, the durable fix is to convert the DEPTID handling in /module/department/controller.php to parameterized statements or prepared queries and to cast the identifier to an integer allow-list, which eliminates the injection rather than filtering it. If the application cannot be patched or the department module is not operationally required, disable or remove that module entirely - this removes the attack surface but also removes department-management functionality for legitimate users. Restrict access to /module/department/controller.php to trusted administrative roles and network ranges (for example, an internal allow-list or VPN-only reachability), accepting that this degrades usability for remote staff while shrinking the authenticated attack population. Deploy a WAF rule blocking SQL metacharacters and known injection signatures on requests to /module/department/* as an interim control, understanding that signature evasion is possible and this is not a substitute for fixing the query. Finally, run the application's database account with least privilege (no DDL, no cross-schema reads) and enable query logging so that tampering attempts against DEPTID are detectable; both measures limit damage but do not prevent successful injection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP web application - itsourcecode's Leave Management System 1.0, a small open-source HR/leave portal - and the vulnerable endpoint is the department module controller at /module/department/controller.php. The flaw is CWE-89 (SQL Injection): the DEPTID request argument is passed into a database query without adequate sanitization or parameterization, so attacker-supplied input is interpreted as SQL syntax rather than as a data value. This is the classic pattern in this class of PHP codebase, where a controller reads a request parameter and concatenates it directly into a query string in the absence of prepared statements or strict type/identifier validation. The CPE record cpe:2.3:a:itsourcecode:leave_management_system:*:*:*:*:*:*:*:* uses a wildcard version, meaning no fixed version is expressed in the affected-product data; the description pins the observed version at 1.0. The submitted CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P, score 5.3) and the assessor's CVSS 3.1 vector agree on the essentials - network reachability, low attack complexity, authenticated access, and no user interaction - but the assessor weights confidentiality impact higher (C:H) than the submitter's low confidentiality rating, and the E:P metric on the 4.0 vector reflects the existence of public exploit code rather than confirmed exploitation.
Know when Leave Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Authenticated network SQLi (PR:L) enabling full database read (C:H) and limited write via injection (I:L); no availability impact and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. The manipulation of the argument DEPTID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Leave Management System
View allLeave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high s
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high s
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high s
An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted s
SQL injection in CodeAstro Leave Management System 1.0 allows remote unauthenticated attackers to manipulate the txt_use
SQL injection in itsourcecode Leave Management System 1.0 allows remote attackers to manipulate database queries via the
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_ema
Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emai
SQL injection in itsourcecode Leave Management System 1.0 lets a low-privileged, authenticated user manipulate the 'ID'
SQL injection in itsourcecode Leave Management System 1.0 lets an authenticated attacker with a low-privilege session (P
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argum
SQL injection in CodeAstro Leave Management System 1.0 exposes the application's database to remote authenticated attack
Exploit-DB