Leave Management System EUVD-2026-35042

The attacker must hold a valid, authenticated session with at least low-level privileges in the CodeAstro Leave Management System admin panel (CVSS PR:L). The vulnerable functionality is the Name search argument within /admin/search_staff_for_deletion.php - this endpoint must be accessible (i.e., the admin panel is reachable from the network). No additional non-default configuration is required beyond having a working installation of version 1.0. Exploitation is limited by the authentication requirement: unauthenticated external parties cannot trigger this vulnerability without first obtaining application credentials. There is no indication of user interaction being required from a victim once the attacker is authenticated.

The CVSS 4.0 base score of 2.1 reflects a constrained impact scope: attack vector is Network (AV:N), complexity Low (AC:L), no required attack prerequisites (AT:N), but privileges are required (PR:L), meaning the attacker must hold at least a low-privileged authenticated session. Confidentiality, integrity, and availability impacts are all rated Low (VC:L/VI:L/VA:L) with no scope change to subsequent systems (SC:N/SI:N/SA:N). The exploit maturity modifier E:P confirms a publicly available proof-of-concept. Despite the low CVSS score, SQL injection in an admin-area search function can yield database enumeration, credential extraction, or data manipulation - real-world impact often exceeds the Low ratings if the database contains sensitive HR data. No EPSS data was provided; no KEV listing exists. The primary limiting factor is the PR:L authentication requirement, which restricts the attacker pool to those with existing application accounts.

An authenticated attacker with a low-privileged admin account navigates to the staff deletion search page and submits a crafted Name parameter such as ' UNION SELECT username,password,3 FROM admin_users-- to the /admin/search_staff_for_deletion.php endpoint. The unsanitized input is executed directly by the database, returning credential hashes from the admin table in the application response. A public proof-of-concept demonstrating this technique is available at https://github.com/jimages/PoC/issues/1.