This vulnerability involves SQL injection in the CodeAstro Leave Management System 1.0, specifically in the /admin/delete_leave_type.php file. The issue arises from improper sanitization or validation of the leave_type parameter, which can be manipulated remotely to inject SQL commands. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. No official fix or patch has been disclosed by the vendor as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated low on confidentiality, integrity, and availability, and the overall severity is medium. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts may help mitigate risk.