Employee Management System CVE-2026-9451

Exploitation requires the attacker to hold a valid low-privilege account on the target Employee Management System 1.0 instance, as confirmed by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data. The vulnerable functionality is the leave application processing workflow accessible via /process/applyleaveprocess.php, which must be reachable over the network (AV:N). No non-default configuration, special feature enablement, or specific deployment mode is required beyond having the application running and the attacker possessing a valid authenticated session. Factors that limit exploitation include: mandatory authentication (no unauthenticated attack path), SSVC 'not automatable' assessment (manual per-request effort required, not mass-exploitable via scanning), partial-only database impact with no lateral movement to secondary systems (SC:N), and the narrow affected product scope - only organizations running this specific application are at risk.

The CVSS 4.0 base score of 2.1 (Low) reflects the PR:L requirement and partial-only impact across VC:L/VI:L/VA:L with no scope change to secondary systems (SC:N/SI:N/SA:N). The network attack vector (AV:N) and low complexity (AC:L) lower the bar for exploitation once authenticated access is obtained, but the low-privilege credential prerequisite is a meaningful real-world limiting factor. The E:P modifier in the CVSS vector confirms POC availability, consistent with the GitHub reference. EPSS at 0.03% (8th percentile) signals very low probability of near-term opportunistic exploitation. SSVC corroborates this - exploitation status is 'poc only', technical impact is 'partial', and the attack is assessed as 'not automatable', meaning each exploitation attempt requires manual attacker effort rather than scripted mass scanning. There is no CISA KEV listing, confirming no verified widespread active exploitation at time of analysis. Overall real-world risk is LOW for the broad population but elevated for any organization directly exposing this specific application, particularly on internet-facing infrastructure where low-privilege accounts may be loosely controlled.

An authenticated low-privilege employee submits a crafted HTTP request to /process/applyleaveprocess.php with an ID parameter containing injected SQL syntax such as 1 UNION SELECT username,password,null FROM users--. The backend SQL query is rewritten by the injected payload, returning rows from unintended tables and exposing credential hashes or sensitive HR records. A public POC documenting this exact technique is available at https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul23.md, providing step-by-step reproduction instructions that lower the attacker skill threshold.