CVE-2026-11507: CodeAstro Leave Management System delete_leave_type.php sql injection
A vulnerability was found in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /admin/deleteleavetype.php. The manipulation of the argument leavetype results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Leave Management System 1.0from your environment.Uninstall or take the CodeAstro Leave Management System offline if it is not required or cannot be adequately protected.
- Configuration
Disable or block access to /admin/delete_leave_type.php (for example rename or remove the file, or deny requests to that path in the webserver) until a code-level fix is available to prevent SQL injection in the leave_type parameter.
CodeAstro Leave Management System (/admin/delete_leave_type.php) access to delete_leave_type.php = disabled or restricted - Compensating control
Restrict access to the application admin area (including /admin/delete_leave_type.php) to trusted IPs and/or place the application behind a WAF or other network controls to block SQL injection attempts.
- Operational
Inspect access and application logs for signs of exploitation of delete_leave_type.php and rotate any credentials or secrets that may have been exposed, since a public exploit exists.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11507?
CVE-2026-11507 has a medium severity rating of 6.3.
How do I fix CVE-2026-11507?
To fix CVE-2026-11507, ensure proper input validation and use prepared statements to prevent SQL injection.
What kind of attack is possible with CVE-2026-11507?
CVE-2026-11507 allows for remote SQL injection attacks through the delete_leave_type.php script.
What software is affected by CVE-2026-11507?
CVE-2026-11507 affects CodeAstro Leave Management System version 1.0.
Can CVE-2026-11507 lead to data loss?
Yes, exploitation of CVE-2026-11507 could potentially lead to data loss or unauthorized data manipulation.