A flaw in the accept.php script of CodeAstro Simple Online Leave Management System 1.0 enables attackers to manipulate the appid parameter so that arbitrary SQL statements are executed against the back‑end database. This allows the stealthy reading, modification, or deletion of leave records and potentially other database contents, compromising confidentiality, integrity, and availability. The weakness is classified as CWE‑89 (SQL Injection) and CWE‑74 (Injection in a typically safe layer).

The vulnerability is limited to CodeAstro Simple Online Leave Management System version 1.0, specifically the administrative POST handler located at /SimpleOnlineLeave/admin/accept.php. No other products or versions are reported to be affected at this time.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% signals a low probability of exploitation in the near term. The public exploit is available and can be performed remotely by sending a crafted POST request to the accept.php endpoint over the web. Successful exploitation would grant an attacker the ability to read, alter, or delete data stored in the system’s database, though the product is not listed in the CISA KEV catalog at this time.