A critical SQL injection flaw in Simple Leave Manager 1.0 permits unauthenticated remote attackers to execute arbitrary database queries, posing a significant risk to data integrity and confidentiality.

The application fails to properly sanitize the table parameter in the user.php script before concatenating it into SQL statements. This allows an unauthenticated attacker to inject malicious SQL commands directly into the backend database.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive employee or administrative data stored within the database. Given the CVSS score of 7.3, this represents a High severity risk that could facilitate full database compromise, potentially leading to unauthorized data exfiltration or administrative account takeover, causing significant reputational and operational damage.

Immediate Action: As no official patch is currently available, administrators should immediately restrict external access to the Simple Leave Manager application or disable the vulnerable user.php endpoint if it is not business critical.

Proactive Monitoring: Review web server access logs for anomalous POST requests to user.php containing SQL syntax or unusual parameter values.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the table parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced GitHub repository.

Given the availability of public proof-of-concept code and the ease of exploitation for unauthenticated attackers, this vulnerability should be treated with high urgency. Organizations using Simple Leave Manager 1.0 must prioritize applying network-level blocks or WAF protections until a vendor-supplied security update is released and verified.