EUVD-2026-77616
GHSA-3p56-4m9v-vc6w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryCraft malicious ID parameter
-
ExploitSubmit to /module/company/index.php
-
ExecutionInject SQL via unsanitized argument
-
ImpactExtract or alter database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires reaching the authenticated company module at /module/company/index.php and supplying an attacker-controlled 'ID' argument that is concatenated into a SQL query without sanitization. The vendor CVSS 4.0 vector's PR:L indicates a low-privileged authenticated session is needed (not fully anonymous), which is the primary limiting factor; no user interaction (UI:N) and no special non-default configuration are called out. Exploitation is further bounded by the product being a single-instance PHP web application (Leave Management System 1.0) with a small deployment base, and a public exploit lowers the practical barrier for anyone who already has account access. |
| Impact | Signals converge on LOW real-world priority despite the SQL injection class carrying a scary reputation. The single-source vendor CVSS 4.0 base score is only 2.1, reflecting PR:L (authentication required) and low impact across all three vulnerable-system metrics (VC:L/VI:L/VA:L) - an unusually restrained score for a VulDB SQLi entry, suggesting the injectable endpoint touches limited data. EPSS is 0.25% (16th percentile), indicating very low predicted exploitation likelihood, and there is NO CISA KEV listing, so there is no evidence of active exploitation. Countervailing signal: a public exploit (E:P / POC) exists on GitHub (lincenjun/submit#1), which lowers the skill barrier but does not by itself indicate mass exploitation. Note a tension worth flagging: SQL injection frequently yields full database read (higher confidentiality than VC:L implies), so the vendor's low impact rating may understate a successful attack; conversely the vendor rated PR:L, meaning some authentication is needed, which contradicts the description's bare 'attack can be initiated remotely' phrasing. Net: a genuine but low-severity, low-prevalence issue, not an urgent priority. |
| Exploit ScenarioDerived | An attacker with a low-privileged authenticated session (PR:L) sends a crafted value in the 'ID' parameter to /module/company/index.php, breaking out of the SQL query to read or manipulate backend database records. A public exploit is already available on GitHub, so the technique requires little custom development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
SQL injection in itsourcecode Leave Management System 1.0 lets a low-privileged, authenticated user manipulate the 'ID' argument of /module/company/index.php to run attacker-controlled SQL against the application's database. The flaw is a classic CWE-89 injection reachable over the network with no user interaction, but it requires an existing account on the application (CVSS 4.0 PR:L; assessed CVSS 3.1 PR:L), which is the main barrier to abuse. Publicly available exploit code exists (a proof-of-concept is linked from the VulDB submission and a GitHub issue), so the practical barrier is low for anyone who already holds credentials; however, EPSS is only 0.25% (16th percentile) and there is no CISA KEV listing, so signals converge on LOW real-world priority despite the injection class.
RemediationAI
No vendor-released patch or fixed version was identified in the available intelligence at time of analysis, so remediation must currently rely on compensating controls. The highest-value fix is code-level: rewrite the query in /module/company/index.php to use parameterized/prepared statements (PDO or mysqli with bound parameters) and cast 'ID' to an integer, since this eliminates the injection entirely rather than filtering it; if source modification is not possible, front the endpoint with a WAF using SQLi signatures, but accept that WAF evasion is well documented and it adds latency. Restrict access to the company module to trusted administrator roles and, where feasible, to specific source IPs, and confirm the underlying database account uses least privilege (read-only where the module only needs reads), which limits exfiltration and tampering if injection succeeds. Because exploitation requires an authenticated session, enforce strong credential hygiene, session expiry and rate limiting on the login path to shrink the population of users who can reach the injection point. If the application is internet-exposed and not actively needed, take it offline or place it behind an authenticated reverse proxy until an upstream fix is released. Track the VulDB entry (https://vuldb.com/vuln/403302), the CVE record (https://vuldb.com/cve/CVE-2026-90796) and the NVD detail page (https://nvd.nist.gov/vuln/detail/CVE-2026-90796) for a patched release, and monitor database/application logs for anomalous SQL errors or unusual parameter patterns as a detection stopgap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP-based web application, itsourcecode Leave Management System (CPE cpe:2.3:a:itsourcecode:leave_management_system, version 1.0), whose /module/company/index.php handler takes a client-supplied 'ID' parameter and concatenates it directly into a database query without parameterization or type enforcement. That is the textbook root cause for CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the injection point is a string-building pattern rather than a database or driver defect. Because the request is routed through the normal web interface, the attack surface is the HTTP endpoint itself; the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, with VC:L/VI:L/VA:L) and our assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) both agree that the attacker must already hold a low-privileged account and that no special non-default configuration or user interaction is required. The impact is bounded by the privileges of the database account the PHP application uses (likely full read/write on the application schema) and by the fact that this is a small-footprint, single-instance PHP product rather than a widely deployed platform.
Know when Leave Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote injectable parameter (AV:N/AC:L) but company module implies a low-priv authenticated session (PR:L); SQLi typically yields database read (C:H) with limited write and no availability loss.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Leave Management System
View allLeave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high s
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high s
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high s
An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted s
SQL injection in CodeAstro Leave Management System 1.0 allows remote unauthenticated attackers to manipulate the txt_use
SQL injection in itsourcecode Leave Management System 1.0 allows remote attackers to manipulate database queries via the
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_ema
Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emai
SQL injection in itsourcecode Leave Management System 1.0 lets an authenticated attacker with a low-privilege session (P
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated user to manipulate the DEPTID argument
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argum
SQL injection in CodeAstro Leave Management System 1.0 exposes the application's database to remote authenticated attack
Exploit-DB