The flaw occurs in deletemp.php where the ID argument is concatenated into a query. This allows a remote attacker to inject SQL that can retrieve, modify, or delete database content. The vulnerability is categorized as CWE-74 and CWE-89, indicating untrusted input used in a database context without proper sanitization. Based on the description, the attack can be executed remotely; however, the CVE description does not provide details on whether authentication is required, so this aspect is inferred and not explicitly stated.

CodeAstro Simple Online Leave Management System version 1.0, accessed through /SimpleOnlineLeave/admin/deletemp.php. No other versions are listed as affected.

With a CVSS score of 5.3, the issue is of moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector is remote; however, specific network or authentication prerequisites are not detailed in the description. Because of the SQL injection nature, if an attacker compromises the database, the impact could include data disclosure or integrity loss.