EUVD-2026-83748
GHSA-899w-qgwj-c7v9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSend crafted ID parameter to /module/department/index.php
-
ExecutionInject SQL via unsanitized argument
-
ImpactExtract database contents (credentials, records)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session on the itsourcecode Leave Management System 1.0 (the vulnerable index.php lives inside the authenticated department administration module, consistent with the vendor's PR:L rating), after which the attacker manipulates the ID GET parameter to inject SQL. No user interaction beyond the attacker's own request is needed and no non-default configuration is required. Limiting factors: valid low-privilege credentials are needed (not unauthenticated), and the product is a rarely-deployed hobbyist application, so exposed instances are scarce. |
| Impact | Real-world risk is moderate-to-low despite a published exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows remote, low-complexity reach but requires at least low privileges (PR:L) - the vulnerable /module/department/index.php sits behind the application's authenticated department module, so this is not an unauthenticated internet-facing flaw. VulDB scores 5.3 with all impacts as VC:L/VI:L/VA:L; I dispute the confidentiality rating: a classic ID-parameter SQL injection typically enables full database dump (credentials, employee/leave records), warranting VC:H rather than VC:L. SSVC signals: exploitation 'Proof-of-Concept' (E:P), and the automatable nature of a single injectable GET parameter is high. No EPSS score and no CISA KEV listing are provided; absence of KEV plus the product's near-zero enterprise footprint means exploitation is opportunistic/CVE-mill-driven, not a widespread campaign. Bottom line: technically valid and easy to exploit for anyone with a low-privilege account, but low priority in practice because the affected product is an obscure hobbyist PHP project rather than production enterprise software. |
| Exploit ScenarioDerived | A low-privileged authenticated user (or an attacker who obtained any weak account) sends a crafted value in the ID parameter to /module/department/index.php, injecting SQL that the backend concatenates unsanitized into a query. This lets them dump the database - including admin credentials and stored leave/employee data - or bypass record-level controls. A proof-of-concept is publicly published on GitHub (ltranquility/submit_repository issue #15), lowering the skill required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
SQL injection in itsourcecode Leave Management System 1.0 lets an authenticated attacker with a low-privilege session (PR:L per the CVSS vectors) read and tamper with database contents through the ID parameter of /module/department/index.php; our independent assessment rates confidentiality impact high and integrity impact low. Publicly available exploit code exists, and the attack is network-reachable with no user interaction and no non-default configuration required. Real-world risk is moderate-to-low despite the published exploit, because the vulnerable endpoint sits inside the authenticated department administration module and the product itself is a rarely deployed hobbyist PHP application.
RemediationAI
No vendor-released patch was identified at time of analysis, and neither VulDB nor the vendor site publishes a fixed version, so remediation must rely on compensating controls until upstream code is corrected. Because the injection is reachable only after login, restrict access to the department administration module (/module/department/) to the smallest possible set of trusted administrator accounts; the trade-off is that legitimate departmental staff lose self-service functionality, but it raises the bar beyond the low-privilege session the exploit needs. Where source code is editable, cast or strictly validate the ID parameter as an integer before it is concatenated into any query and convert the query to a parameterized prepared statement in /module/department/index.php; the trade-off is developer time, regression testing of the department listing, and the need to propagate the same fix pattern to sibling modules. Constrain the application's database account to the least privilege it needs, ideally SELECT-only on the tables it reads, so an injected statement cannot escalate to writes or schema changes; the trade-off is that write-dependent features of the application may break and will require a separate, more privileged account. At the edge, deploy a WAF or reverse-proxy rule that rejects SQL metacharacters and UNION/boolean constructs in the ID parameter of the department endpoint and alert on them in web logs; the trade-off is potential false positives and tuning effort. Given the application is a seldom-deployed hobbyist codebase with no maintained patching channel, the most durable mitigation is to migrate off it or take the instance offline; meanwhile, monitor reference https://vuldb.com/vuln/407960 and the vendor site https://itsourcecode.com/ for an eventual fix version, and use the public exploit at https://github.com/ltranquility/submit_repository/issues/15 to validate any mitigation before relying on it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 improper neutralization of special elements in an SQL command, where user-supplied input reaches a database query without parameterization. The affected component is a PHP web application, itsourcecode Leave Management System 1.0, identified by CPE cpe:2.3:a:itsourcecode:leave_management_system (the CPE leaves the version wildcarded while ENISA EUVD explicitly records 1.0 as the affected release). The vulnerable path, /module/department/index.php, belongs to the administrative department-management module, which is why both the CVSS 4.0 vector (PR:L) and our independent CVSS 3.1 assessment (PR:L) require a valid authenticated session; the CVSS 4.0 vector also carries AT:N, UI:N and E:P, the last reflecting that proof-of-concept exploit code has been published. VulDB, listed as the reporting source, describes an unknown part of index.php being affected, but the exploit reference and public reporting point to manipulation of the ID argument as the injection vector. EPSS and CISA KEV data were not supplied, so no active-exploitation signal is available; the only exploitability signal is the public proof-of-concept.
Know when Leave Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote low-complexity SQLi needing a low-privilege account (PR:L); classic ID-parameter injection allows full DB read (C:H) and limited write (I:L), no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Leave Management System
View allLeave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high s
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high s
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high s
An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted s
SQL injection in CodeAstro Leave Management System 1.0 allows remote unauthenticated attackers to manipulate the txt_use
SQL injection in itsourcecode Leave Management System 1.0 allows remote attackers to manipulate database queries via the
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_ema
Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emai
SQL injection in itsourcecode Leave Management System 1.0 lets a low-privileged, authenticated user manipulate the 'ID'
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated user to manipulate the DEPTID argument
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argum
SQL injection in CodeAstro Leave Management System 1.0 exposes the application's database to remote authenticated attack
Exploit-DB