Executive brief
itsourcecode Leave Management System is a web-based application for managing employee leave requests. An attacker can manipulate the 'id' parameter in the leave type editor to inject malicious SQL commands, allowing unauthorized access to the database, theft of sensitive personnel data, and modification or deletion of leave records. The vulnerability requires valid login credentials but poses a serious risk to organizational data integrity and employee privacy.
Technical details
A SQL injection vulnerability exists in /module/leavetype/index.php where the 'id' parameter is not properly sanitized before inclusion in SQL queries. An authenticated attacker can craft malicious SQL payloads via the 'id' GET parameter to extract, modify, or delete database records. The vulnerability allows escalation from authenticated user to database-level compromise through time-based or error-based SQL injection techniques.
Affected products
- itsourcecode Leave Management System 1.0
Timeline
- 2026-08-29: disclosed
- 2026-09-23: advisory