Leave Management System EUVD-2026-84988

Requires an authenticated low-privileged account (CVSS PR:L) and network access to the application's /module/leavetype/index.php endpoint; exploitation is performed by manipulating the ID argument to inject SQL. Limiting factors: valid credentials are needed (not unauthenticated), the target is the niche itsourcecode Leave Management System 1.0, and the CVSS 4.0 impacts are all rated Low. A public PoC exists, reducing the skill required, but there is no evidence of automated or widespread exploitation.

This is a low-real-priority issue despite the SQL injection classification. The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scoring only 2.1, with all three impacts rated Low and E:P indicating a proof-of-concept exploit maturity. The vector's PR:L confirms authentication is required (low-privileged), which meaningfully limits exposure. No EPSS score, no CISA KEV listing, and no confirmed active exploitation are present in the input - the only positive exploitation signal is that public exploit code exists (description: 'The exploit has been made available to the public'). Signals are broadly consistent: a network-reachable but authentication-gated SQLi in an obscure PHP application with a public PoC but no evidence of mass or targeted exploitation. The CWE is tagged CWE-74 (generic injection) whereas the actual weakness is SQL injection (properly CWE-89) - a labeling imprecision, not a scoring conflict. My independent view is that a classic ID-parameter SQL injection typically enables database contents disclosure, so the confidentiality impact may be understated by VulDB's Low rating; however, the trivial CRUD-app context and authentication requirement keep overall priority low. This is a real but low-severity, low-prevalence finding - patch during routine maintenance, not an emergency.

An authenticated low-privileged user of the itsourcecode Leave Management System sends a crafted value in the ID argument to /module/leavetype/index.php, injecting SQL into the backend query to read database records such as user or leave-type data. A public proof-of-concept exploit exists (referenced via VulDB), lowering the skill barrier, though exploitation requires valid low-privilege credentials (PR:L) and network access to the application.