This vulnerability in CodeAstro Leave Management System 1.0 involves SQL injection via the 'Name' parameter in the /admin/search_staff_to_assign_pc.php file. The flaw allows remote attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official remediation or patch has been published by the vendor as of the data provided.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure or modification. However, the impact is rated as low to medium on confidentiality, integrity, and availability, reflecting limited potential damage or exploit complexity. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'Name' parameter to mitigate SQL injection risks. Monitoring for unusual database queries and restricting access to the affected functionality may also reduce exposure.