The vulnerability in SourceCodester Online Leave Management System 1.0 arises from improper sanitization of the date_start and date_end parameters in the /admin/?page=reports endpoint. This flaw enables SQL injection attacks, allowing an attacker with high privileges to remotely execute unauthorized SQL commands. The vulnerability is publicly documented under CVE-2026-102912 with a CVSS 4.0 base score of 5.1, indicating medium severity. No official patch or remediation information is provided, and no known active exploitation has been reported.

Successful exploitation of this SQL injection vulnerability could allow an attacker with high privileges to manipulate database queries, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to the requirement of high privileges and limited scope of the vulnerability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious activity related to the date_start and date_end parameters. Avoid using the vulnerable version in production environments if possible.