This vulnerability involves an SQL injection in the CodeAstro Leave Management System 1.0, specifically in the /admin/add_leave.php file. By manipulating the type_of_leave argument, an attacker can inject SQL commands remotely, potentially compromising the database. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. No official patch or remediation level has been provided by the vendor, and no cloud service is involved.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk. However, the CVSS score indicates a medium impact, and no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries on the affected parameter (type_of_leave) to mitigate SQL injection risks. Monitor vendor communications for updates on patches or official mitigations.