Executive brief
The Leave Management System is a PHP-based employee management application used for tracking leave requests and approvals. A SQL injection vulnerability in the login form allows unauthenticated attackers to inject malicious SQL commands through the user email field, potentially exposing or modifying the entire database including employee records, payroll data, and sensitive leave information.
Technical details
The vulnerability is a classic SQL injection flaw in the /login.php file where the 'user_email' parameter is not properly sanitized before being used in SQL queries. The application constructs dynamic SQL statements by directly concatenating user input without using prepared statements or parameterized queries. Attackers can exploit this via POST requests to the login endpoint without requiring authentication, using techniques like UNION-based or time-based blind SQL injection. The PoC demonstrates UNION-based injection to extract database metadata. An attacker can read/modify arbitrary database records, bypass authentication, or gain administrative control. The recommended fix involves implementing prepared statements/parameter binding, input validation, and principle of least privilege for database credentials.
Affected products
- itsourcecode Leave Management System 1.0
Timeline
- 2026-08-09: disclosed: Vulnerability disclosed on GitHub
- 2026-09-14: advisory: CVE-2026-90789 published