Description
A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-10-01
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the controller.php of itsourcecode Leave Management System 1.0, where an unknown function handles the LEAVTID argument. By manipulating this argument, an attacker can inject arbitrary SQL statements, allowing remote modification, disclosure, or deletion of database content. The flaw falls under SQL Injection weaknesses such as improper validation of input leading to query execution.

Affected Systems

vulnerable product: itsourcecode Leave Management System, version 1.0. The affected file is /module/leavetype/controller.php. No alternative versions or patches are listed in the CVE data.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and has been publicly disclosed, meaning that attackers can exploit the flaw over the network if the system is exposed. The overall risk is moderate, with potential impact on confidentiality and integrity of the underlying database.

Generated by OpenCVE AI on October 1, 2026 at 08:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched version of itsourcecode Leave Management System if the vendor releases an update addressing the LEAVTID injection.
  • If a patch is not immediately available, modify the controller to use parameterized queries or stored procedures, ensuring that the LEAVTID value is always safely bound and not concatenated into SQL statements.
  • Limit exposure by configuring network boundaries so that the /module/leavetype endpoint is only reachable from trusted IP ranges, reducing the attack surface.
  • Deploy a web application firewall that detects and blocks SQL injection patterns targeting the LEAVTID parameter.

Generated by OpenCVE AI on October 1, 2026 at 08:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Title itsourcecode Leave Management System controller.php sql injection
First Time appeared Itsourcecode
Itsourcecode leave Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:leave_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode leave Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Leave Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-01T19:10:43.879Z

Reserved: 2026-09-30T19:07:55.116Z

Link: CVE-2026-103543

cve-icon Vulnrichment

Updated: 2026-10-01T19:10:37.416Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T06:17:07.620

Modified: 2026-10-01T20:17:23.637

Link: CVE-2026-103543

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T08:45:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')