The code-projects Simple Leave Manager application contains a SQL injection vulnerability that allows remote, unauthenticated attackers to potentially compromise database integrity.

This is a SQL injection vulnerability (CWE-89) occurring in the request.php file. The application fails to properly sanitize the staff_id parameter, allowing an unauthenticated attacker to inject malicious SQL commands remotely.

The exploitation of this flaw could lead to unauthorized data access, modification, or deletion within the underlying database. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to the confidentiality and integrity of employee leave records managed by the software.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or take the service offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests to request.php containing SQL syntax characters, such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the staff_id parameter.

Public Exploit Available: Yes, a public proof of concept exists as documented in the GitHub issue referenced by the vulnerability disclosure.

Given the availability of public proof of concept code, this vulnerability represents an immediate risk to any deployment of Simple Leave Manager 1.0. Organizations should prioritize isolating the affected application from public-facing networks until the vendor provides a formal security update or patch to remediate the underlying injection flaw.