VYPR
← All advisories
Medium severity6.3NVD Advisory· Published Jun 8, 2026· Updated Jun 8, 2026

CVE-2026-11506

CVE-2026-11506

Description

SQL injection in CodeAstro Leave Management System 1.0 allows remote attackers to access, modify, or delete database data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SQL injection in CodeAstro Leave Management System 1.0 allows remote attackers to access, modify, or delete database data.

Vulnerability

A SQL injection vulnerability exists in CodeAstro Leave Management System version 1.0, specifically within the /admin/search_staff_for_deletion.php file. The vulnerability arises from the improper handling of the Name argument, which is directly incorporated into SQL queries without adequate sanitization or validation [1].

Exploitation

An attacker can exploit this vulnerability remotely by manipulating the Name argument. By injecting malicious SQL code into this parameter, an attacker can alter the intended SQL query. This requires the attacker to know the vulnerable file path and to be able to send a crafted request to it [1].

Impact

Successful exploitation of this SQL injection vulnerability allows an attacker to gain unauthorized access to the database. This can lead to sensitive data leakage, modification or deletion of data, and potentially full control over the system, impacting data integrity and availability [1].

Mitigation

No patched version or specific mitigation details have been disclosed in the available references. The vendor's homepage is provided [2].

References
  1. codeastro Leave Management System V1.0 /LeaveManagement-PHP/admin/search_staff_for_deletion.php SQL injection
  2. CodeAstro

AI Insight generated on Jun 8, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The application does not properly sanitize user-supplied input in the 'name' parameter, allowing for SQL injection."

Attack vector

An attacker can exploit this vulnerability by sending a crafted POST request to the `/admin/search_staff_for_deletion.php` file. The manipulation occurs via the 'name' argument, which is directly incorporated into SQL queries without adequate validation or sanitization. This allows attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification [ref_id=1].

Affected code

The vulnerability resides in the `/admin/search_staff_for_deletion.php` file within the CodeAstro Leave Management System version 1.0 [ref_id=1]. The 'name' parameter in this file is susceptible to manipulation.

What the fix does

The advisory suggests using prepared statements with parameter binding to prevent SQL injection. This method separates SQL code from user input, ensuring that user-supplied data is treated as literal values and not executable SQL commands. Additionally, input validation and filtering should be implemented to ensure data conforms to expected formats. Minimizing database user permissions and conducting regular security audits are also recommended remediation steps [ref_id=1].

Preconditions

  • authThe attacker needs to have low privileges (PR:L) to exploit this vulnerability.
  • networkThe vulnerability is remotely exploitable (AV:N).

Generated on Jun 8, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

1