Executive brief
itsourcecode Leave Management System is a free PHP-based application used by organizations to manage employee leave requests and tracking. A SQL injection vulnerability in the employee module allows attackers to bypass security controls, extract sensitive employee data, modify records, or disrupt service availability. This affects the integrity and confidentiality of human resources data.
Technical details
A SQL injection vulnerability exists in /module/employee/index.php where the 'id' parameter is not properly sanitized before being used in SQL queries. The vulnerability can be exploited remotely without authentication by injecting malicious SQL code through the 'id' GET parameter (e.g., using UNION-based or time-based blind SQL injection techniques). An attacker can enumerate the database, extract sensitive employee information, modify or delete records, or potentially achieve remote code execution depending on database permissions. The vulnerability is disclosed and a proof-of-concept exploit is publicly available; the vendor has not released a patch. Remediation requires using prepared statements with parameterized queries and implementing strict input validation.
Affected products
- itsourcecode Leave Management System 1.0
Timeline
- 2026-08-18: disclosed: Vulnerability disclosed on GitHub
- 2026-09-16: advisory: CVE-2026-92364 published