Leave Management System EUVD-2026-35050

Exploitation requires a valid low-privilege authenticated session within the CodeAstro Leave Management System 1.0 (CVSS PR:L confirms authentication is needed - unauthenticated exploitation is not indicated). The vulnerable endpoint is /admin/add_leave.php, meaning the attacker must have network access to the admin panel - if the admin interface is not exposed to the public internet, the attack surface is reduced to internal or authenticated network users. No special non-default configuration is required; the vulnerability is present in the default 1.0 installation. Limiting factors include: the requirement for at least a low-privilege authenticated account, and any network-level restrictions on admin panel access. The attack complexity is low (AC:L) with no additional attack conditions (AT:N), meaning no race conditions or unusual circumstances are needed once access is obtained.

The CVSS 4.0 score of 2.1 appears significantly understated relative to the realistic threat posture. The CVSS vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring only low-privilege authenticated access - conditions that are routinely met in real deployments. The E:P modifier confirms a publicly available proof-of-concept exploit. SQL injection with low-privilege access in an admin panel often enables privilege escalation, credential theft, or full database compromise, which the limited VC:L/VI:L/VA:L scope ratings may underrepresent. No EPSS score was provided in the input data, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed mass exploitation at time of analysis. However, the combination of a public exploit, network accessibility, and low authentication bar for an admin-facing PHP application makes this a meaningful priority for any operator of this software - particularly since the target demographic (small organizations using free leave management tools) may lack active monitoring. The CVSS score should not be used in isolation here; the real-world exploitability signals are more alarming than the numeric score implies.

An attacker with a low-privilege account (e.g., a standard employee account in the leave management system) navigates to the admin leave submission endpoint /admin/add_leave.php and submits a crafted HTTP request where the type_of_leave parameter contains SQL injection syntax such as ' OR 1=1--. The application passes the unsanitized value directly into a SQL query, allowing the attacker to enumerate database tables, extract credentials or personal data, or modify leave records. A public proof-of-concept at https://github.com/Andelstander/cve/issues/3 reduces the technical barrier to exploitation.