The itsourcecode Leave Management System is vulnerable to an unauthenticated SQL injection attack that enables unauthorized password resets for all system users.

This is a SQL injection vulnerability (CWE-89) located in the reset.php file. An unauthenticated attacker can manipulate the employid argument to execute arbitrary SQL commands, bypassing user verification and modifying password records in the backend database.

Successful exploitation grants an attacker the ability to perform a bulk password reset on all user accounts, including administrative accounts. This results in a total compromise of the application, leading to unauthorized access to sensitive employee data and administrative functionality. While the CVSS score is 7.3, the impact of full account takeover and the availability of a functional proof-of-concept elevate the urgency of this risk.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the reset.php endpoint or disable the password reset functionality until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at reset.php, specifically looking for payloads containing SQL syntax such as OR 1=1 or other boolean manipulation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing SQL injection patterns directed at the password recovery module.

Public Exploit Available: Yes, a functional proof-of-concept and technical advisory are available via the researcher's GitHub repository.

Given the critical nature of this vulnerability and the availability of public proof-of-concept code, immediate action is required to protect the integrity of user accounts. If the software cannot be patched or the specific vulnerable endpoint secured, consider taking the application offline to prevent mass account takeover until a permanent fix is provided by the developer.