Leave Management System CVE-2026-9542

The CVSS 4.0 vector PR:L confirms that at minimum low-privileged authentication is required; the /admin/ path in the vulnerable endpoint strongly implies administrative panel access is the realistic requirement, meaning an attacker must first obtain valid admin credentials through phishing, credential stuffing, or another vector. AT:N confirms no additional technical prerequisites (no special library, no race condition, no specific OS configuration). The attack is limited to CodeAstro Leave Management System version 1.0 specifically; organizations not running this niche PHP application are not affected. No user interaction is required beyond the attacker's own authenticated session (UI:N). Exploitation is bounded by the admin authentication barrier - unauthenticated remote exploitation is NOT indicated by available data.

Multiple signals converge on a low real-world priority. The CVSS 4.0 base score of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N) assigns Low complexity and no additional technical requirements, but PR:L confirms at least low-privileged authenticated access is required - and the /admin/ path strongly implies administrative credentials are the realistic prerequisite, which materially reduces the attack surface. Impact is bounded: VC:L/VI:L/VA:L with SC:N/SI:N/SA:N indicates limited blast radius confined to the vulnerable component with no scope change. EPSS at 0.03% (8th percentile) is consistent with a niche, small-user-base PHP application unlikely to attract automated scanning campaigns. The publicly available POC (GitHub) is a meaningful signal but does not equate to active exploitation - KEV status is not confirmed. The overall picture is: technically exploitable by an authenticated admin-level user against a specific PHP application version, but low priority relative to unauthenticated, high-impact, KEV-listed vulnerabilities.

An attacker with administrative credentials to the CodeAstro Leave Management System authenticates to the admin panel and submits a crafted HTTP request to /admin/add_staff.php with a malicious email_id value such as ' OR 1=1 UNION SELECT ...--, causing the backend SQL query to return or modify unintended data. A publicly available proof-of-concept on GitHub (https://github.com/wangchaoxing/CVE/issues/8) demonstrates the technique, lowering the bar for exploitation to script-kiddie level for any attacker already holding admin credentials.