Leave Management System EUVD-2026-90888

Exploitation requires an authenticated session with at least low-privilege access to the Leave Management System (CVSS PR:L), after which the attacker must reach the /module/leave/controller.php endpoint and supply a manipulated LEAVEID request parameter. No user interaction and no special non-default configuration are needed (UI:N, AC:L), but the mandatory valid account and the tiny deployment base are the primary factors limiting real-world exploitation; impact is partial (limited read/write to database contents) rather than full system compromise.

This is a low-priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) shows a network-exploitable, low-complexity SQL injection, but the vendor-assigned base score is only 2.1 because impact is capped at VC:L/VI:L/VA:L and, critically, PR:L means an attacker must already hold valid (low-privileged) credentials. The exploit maturity is E:P (proof-of-concept), and the description confirms exploit code has been published - this maps to 'publicly available exploit code exists', not active exploitation. There is no CISA KEV listing and no EPSS value supplied in the input, so widespread opportunistic exploitation cannot be inferred. The dominant risk-limiting factors are the authentication requirement and, above all, the product's negligible real-world footprint (a small itsourcecode PHP tutorial application). Net: a genuine but very low-severity authenticated SQLi in an obscure application - publicly documented but unlikely to be a priority outside environments that specifically run this software.

An authenticated low-privilege user of the Leave Management System sends a crafted value in the LEAVEID parameter to /module/leave/controller.php, injecting SQL that the backend executes against the application database. Because a proof-of-concept has been published, a low-skill attacker with any valid account could reproduce it to read or tamper with limited database contents. The attack is remote over the network but constrained to the low partial impacts (VC:L/VI:L/VA:L) reflected in the CVSS vector.