This vulnerability allows an attacker to perform SQL injection by manipulating the email_id parameter in the /admin/add_staff.php file of CodeAstro Leave Management System 1.0. The attack vector is network accessible with low attack complexity and no privileges or user interaction required. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Exploit code is publicly available, but no official fix or patch has been disclosed as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of exploitation. However, the CVSS score and vector indicate limited impact on confidentiality, integrity, and availability (low to limited impact).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently available, organizations should consider restricting access to the affected endpoint (/admin/add_staff.php) and monitor for suspicious activity. Applying input validation or web application firewall rules to block malicious SQL injection attempts may provide temporary mitigation.