A SQL injection flaw exists in the login.php file of CodeAstro Leave Management System 1.0. By manipulating the txt_username argument, an attacker can inject arbitrary SQL, potentially bypassing authentication and retrieving or altering database contents. The weakness is identified as input unsanitized, aligning with CWE-74 and CWE-89. Successful exploitation could allow unauthorized access to sensitive employee data and modifications that compromise system integrity.

Affected products are CodeAstro:Leave Management System version 1.0. Only the login.php endpoint is vulnerable, and the flaw is present in the current 1.0 release. No other versions or modules are explicitly listed.

The CVSS score of 6.9 indicates high severity, and although the EPSS score is not available, the vulnerability is publicly available and can be triggered remotely via the web interface. It is not listed in CISA’s KEV catalog, but the remote nature and potential for data exfiltration mean that organizations should treat it as a significant risk. The available exploit code suggests a low barrier to exploitation for attackers with web access.