The vulnerability arises in the delete_leave_type.php file of CodeAstro Leave Management System 1.0. The leave_type argument is not properly sanitized, enabling an attacker to inject malicious SQL statements. This allows the attacker to modify or delete database rows, potentially leading to data corruption or loss of critical leave records. It is classified as a SQL injection flaw affecting data integrity and availability.

CodeAstro: Leave Management System version 1.0 is affected by this flaw. The issue is specific to the delete_leave_type.php module and the leave_type parameter within that file. No other versions or products are explicitly listed in the current advisory.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation in the wild is unclear, but the vulnerability can be triggered remotely via a web request to the affected endpoint. The vulnerability is not listed in the CISA KEV catalog, which reduces the confidence that a publicly supported exploit is in use today. Nevertheless, because the flaw is exploitable through the public web interface and the exploit has been disclosed, organizations should treat it as a real threat.