Executive brief
CodeAstro Leave Management System, a web application used for managing employee time-off requests, contains a security vulnerability in its administrative search interface. An attacker with low-level access can exploit this flaw to gain unauthorized access to the underlying database. This could result in the theft of sensitive employee information, unauthorized modification of records, or disruption of the management system.
Technical details
A SQL injection vulnerability exists in CodeAstro Leave Management System 1.0 within the '/admin/search_staff_for_deletion.php' file. The root cause is the improper neutralization of the 'name' POST parameter before its use in a SQL query. An attacker with administrative or low-privileged access (depending on session requirements) can provide malicious input to perform boolean-based blind, time-based blind, or UNION-based SQL injection. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public proof-of-concept (PoC) has been disclosed.
Affected products
- CodeAstro Leave Management System 1.0
Timeline
- 2026-05-22: disclosed: Public PoC published on GitHub
- 2026-06-08: advisory: NVD/VulDB advisory published