This vulnerability allows remote attackers to perform SQL injection via the ID parameter in the /module/employee/index.php file of itsourcecode Leave Management System 1.0. The injection flaw could enable unauthorized database queries, potentially leading to data exposure or manipulation. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no user interaction required, and limited confidentiality, integrity, and availability impacts. Exploit details have been publicly disclosed, but no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. There is no indication of privilege escalation or system-level compromise from the provided data.

No official patch or remediation guidance is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement input validation and parameterized queries on the affected parameter to mitigate SQL injection risks.