A SQL injection vulnerability in the itsourcecode Leave Management System version 1.0 allows authenticated users to execute unauthorized database commands, posing a significant risk to data integrity.

The application fails to properly sanitize user-supplied input in the id parameter within the /module/leavetype/index.php file, allowing an authenticated attacker to inject malicious SQL queries. This flaw leverages the application's database interaction layer to perform unauthorized operations.

The vulnerability allows for potential unauthorized database access, which may lead to the exposure of sensitive employee information, data tampering, or complete system compromise. Given the CVSS score of 6.3, this represents a moderate risk that could result in significant operational disruption and loss of confidentiality for organizations utilizing this software.

Immediate Action: There is currently no vendor-provided patch for this version; users should restrict access to the application and audit existing database permissions to minimize potential impact.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, specifically looking for unexpected use of concatenation, floor functions, or SQL syntax keywords in the /module/leavetype/index.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the id parameter, providing a virtual patch until an official update is released.

Public Exploit Available: Yes — a public proof-of-concept is available via the researcher's GitHub repository.

Organizations running the itsourcecode Leave Management System 1.0 must treat this vulnerability with urgency. Since an official patch is not yet available, administrators should prioritize implementing compensating controls such as WAF rules and restricting access to the management interface. Continuous monitoring of database logs is essential until a secure version is provided by the vendor.