Executive brief
CodeAstro Simple Online Leave Management System, a web application used for managing employee leave requests, contains a security vulnerability in its administrative dashboard. An attacker with basic user access can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive employee information, unauthorized modification of records, or disruption of the leave management service.
Technical details
A SQL injection vulnerability exists in CodeAstro Simple Online Leave Management System 1.0 within the '/SimpleOnlineLeave/admin/dashboard.php' file. The root cause is the improper neutralization of special elements in the 'Name' POST parameter, which is used directly in SQL queries without adequate validation or prepared statements. A remote attacker with low-level privileges can exploit this via time-based blind SQL injection (e.g., using the SLEEP function) to extract sensitive data or manipulate the database. A public exploit (PoC) using sqlmap has been disclosed. No official patch is currently documented, but remediation should involve implementing prepared statements with parameter binding.
Affected products
- CodeAstro Simple Online Leave Management System 1.0
Timeline
- 2026-06-10: disclosed: Vulnerability details and PoC shared on GitHub issue
- 2026-07-13: advisory: CVE published to NVD dataset