Executive brief
CodeAstro Leave Management System, a web application used to track employee time-off requests, contains a security flaw in its administrative interface. An attacker with basic user access can manipulate database queries to view, modify, or delete sensitive information. This could lead to unauthorized access to employee records or disruption of the leave approval process.
Technical details
A SQL injection vulnerability exists in CodeAstro Leave Management System 1.0 within the /admin/delete_leave_type.php file (also referenced as delete_leave_type_db.php). The root cause is the failure to sanitize the 'leave_type' GET parameter before using it in a database query. An authenticated attacker with network access to the administrative panel can exploit this using time-based blind SQL injection techniques. Successful exploitation allows for unauthorized database access, data exfiltration, and potential tampering with system records. A public Proof of Concept (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Leave Management System 1.0
Timeline
- 2026-05-22: disclosed: Public PoC published on GitHub
- 2026-06-08: advisory: CVE published and indexed by VulDB/NVD