Executive brief
itsourcecode Leave Management System is a PHP-based web application for managing employee leave requests and department data. An SQL injection vulnerability in the department controller allows authenticated attackers to inject malicious SQL code through the DEPTID parameter, potentially leading to unauthorized database access, data theft, modification, or complete system compromise.
Technical details
An unauthenticated SQL injection vulnerability exists in /module/department/controller.php via the DEPTID parameter. The application fails to sanitize or validate user input before incorporating it into SQL queries, allowing attackers to execute arbitrary SQL commands. Although the GitHub issue claims no authentication is required, the actual attack vector requires valid session context, and exploitation can lead to database exfiltration, manipulation, or denial of service.
Affected products
- itsourcecode Leave Management System 1.0
Timeline
- 2026-08-23: disclosed
- 2026-09-20: advisory