A SQL injection vulnerability exists in CodeAstro Simple Online Leave Management System 1.0 within the /SimpleOnlineLeave/admin/dashboard.php file. The vulnerability is triggered by manipulation of the 'Name' parameter, enabling an attacker to inject malicious SQL commands remotely. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction required, and limited scope and impact. The vulnerability is publicly disclosed with exploit code available, but no vendor remediation or patch has been published as of now.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the vulnerability's low scope and impact metrics, but it still poses a risk to data confidentiality and integrity within the affected system.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is provided, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'Name' parameter in the affected endpoint. Restricting database user privileges and input validation may also help reduce risk.