Description

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T17:17:56.430Z",
  "pubdate": "2026-09-14T17:17:56.430Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the itsourcecode Leave Management System version 1.0.\nThe vulnerability resides within the /module/company/index.php file, specifically affecting the handling of the ID argument.\nThis flaw permits remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database, potentially leading to unauthorized data access, modification, or deletion.\nThe risk is significantly elevated due to the public availability of an exploit, making active exploitation likely.\nSuccessful exploitation compromises the confidentiality, integrity, and availability of the application's data, necessitating immediate attention and remediation to prevent unauthorized database interactions.",
  "technicalDetails": "The vulnerability is categorized as a classic SQL injection flaw stemming from improper sanitization or validation of user-supplied input.\nThe application processes the ID argument within /module/company/index.php without utilizing parameterized queries or prepared statements, allowing the input to directly influence the structure and logic of the SQL statement executed by the database management system.\nThe attack flow initiates when a remote, unauthenticated attacker crafts a malicious HTTP request targeting /module/company/index.php with a manipulated ID parameter.\nBy injecting SQL meta-characters (such as single quotes, comments, or union operators) into the ID parameter, the attacker can break out of the intended query context and append arbitrary SQL commands.\nThe database engine executes the injected code with the same privileges as the application's database user, enabling the attacker to bypass authentication mechanisms, dump sensitive data from tables, modify application configurations, or, depending on database configuration, execute administrative commands or interact with the underlying operating system file system.\nThe vulnerability affects itsourcecode Leave Management System version 1.0 and is exploitable remotely over the network without requiring prior authentication, significantly increasing its severity and exploitability surface.\nGiven that proof-of-concept exploit code is publicly available, the barrier to entry for potential attackers is minimal, allowing for automated scanning and exploitation."
}