SQL Injection in itsourcecode Leave Management System

The itsourcecode Leave Management System version 1.0 contains a SQL injection vulnerability within the /login.php file. The application fails to properly sanitize the user_email parameter before incorporating it into backend database queries. A remote, unauthenticated attacker can exploit this flaw by submitting crafted SQL payloads to the login endpoint. Successful exploitation may allow an attacker to bypass authentication, extract sensitive information from the database, or modify records. Public exploit code for this vulnerability has been released, increasing the likelihood of opportunistic exploitation against deployments of this system. Organizations using this software should restrict access to the login portal and investigate internal alternatives while awaiting a vendor patch.

Impact

Successful exploitation of this vulnerability allows unauthorized access to the Leave Management System database. Depending on the database configuration and permissions, this could result in complete compromise of user credentials, leave history, and employee personal information stored within the system.

Recommendation

• Monitor web server access logs for anomalous characters (e.g., single quotes, double dashes, semicolon, or SQL keywords like UNION, SELECT) within the user_email parameter sent to /login.php.
• Implement strict input validation or parameterized queries at the application layer to sanitize the user_email input field.
• Apply web application firewall (WAF) rules to inspect and block requests containing common SQL injection patterns targeting the /login.php endpoint.