CodeAstro Leave Management System EUVD-2026-28521

No special conditions are required beyond network connectivity to the CodeAstro Leave Management System instance. The login endpoint at /login.php is accessible to remote unauthenticated users (PR:N), making exploitation possible against any publicly exposed or internally accessible deployment without additional authentication, non-default configuration, or user interaction. The sql injection vulnerability is triggered simply by submitting a malicious string in the txt_username parameter of the login form. Exploitation is limited only by the scope of SQL permissions of the application's database account and network reachability of the /login.php endpoint.

The CVSS v4.0 score of 5.5 reflects low confidentiality and integrity impact (VC:L/VI:L) with no scope change, indicating the attacker gains limited database read/write access rather than full system compromise. However, the risk assessment must be elevated beyond the raw CVSS score: publicly available exploit code (POC confirmed), no authentication required (PR:N), and remote network access (AV:N/AC:L) combine to create a practical exploitation threat. The vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at scale, but the public POC significantly lowers the barrier to entry for opportunistic attackers. For a web application managing sensitive HR and leave data, even 'low' confidentiality and integrity impact could expose personally identifiable information or allow unauthorized leave approvals. The real-world risk is moderate to high for exposed instances, but the limited scope compared to RCE or authentication bypass keeps it below critical.

An unauthenticated attacker crafts an HTTP POST request to the login endpoint with malicious SQL syntax injected into the txt_username field, such as 'admin' OR '1'='1'--. The application concatenates this unsanitized input directly into a SQL query without parameterization, allowing the attacker to extract sensitive data from the leave management database (employee names, leave balances, approval workflows) or modify records without authentication. Publicly available exploit code on GitHub lowers the technical skill required to launch such an attack.