Leave Management System EUVD-2026-89607

Requires an authenticated administrator session on the SourceCodester Online Leave Management System 1.0 (PR:H), because the vulnerable endpoint is the admin reporting page /admin/?page=reports. Exploitation is performed remotely over the network by supplying malicious SQL in the date_start or date_end request parameters; no user interaction and no non-default configuration are needed beyond having admin access. The high-privilege requirement is the primary limiting factor - an unprivileged or unauthenticated remote attacker cannot reach the flaw, confining realistic risk to malicious admins or attackers who have already compromised an admin account.

This is a high-CVSS-does-NOT-apply case - the assigned CVSS 4.0 base score is only 2.0, reflecting a genuinely low-severity finding despite SQL injection being a serious bug class in the abstract. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) tells the real story: network-reachable and low-complexity, but requiring high privileges (PR:H) and yielding only Low impact to confidentiality, integrity, and availability. The injection point is /admin/?page=reports, an administrative endpoint, consistent with PR:H - the attacker must already hold admin-level access. The 'E:P' in the vector plus VulDB's note that 'the exploit is publicly available' means publicly available exploit code exists (per the linked GitHub issue), but there is NO EPSS score provided, NO CISA KEV listing, and NO SSVC decision data. Signals are internally consistent here - low real-world risk driven by the privilege requirement and limited impact - so this is a low-priority issue rather than a high-CVSS-but-overrated one. The main caveat: date_start/date_end reaching a SQL query suggests the actual impact could be higher than the vendor's conservative VC:L/VI:L/VA:L if the injection allows full database read, but no evidence contradicts the vendor rating, so treat impact as Low absent independent verification.

An attacker who already possesses valid administrator credentials for the Online Leave Management System navigates to /admin/?page=reports and submits crafted date_start or date_end parameter values containing SQL syntax, which the application concatenates into a backend query. Publicly available exploit code (referenced in the linked GitHub issue) demonstrates the injection, allowing the authenticated attacker to extract or manipulate limited database contents. Because admin privileges are a prerequisite (PR:H), realistic exploitation is largely limited to malicious insiders or attackers who have separately compromised an admin account.