CVE-2026-90796: Leave Management System SQL Injection Flaw

CVE-2026-90796 Overview

CVE-2026-90796 is a SQL injection vulnerability in itsourcecode Leave Management System 1.0. The flaw resides in the /module/company/index.php file, where the ID parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements against the backend database. The issue is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The attack can be executed remotely over the network and requires low-level privileges. Public disclosure of exploit details has occurred through third-party vulnerability databases.

Critical Impact
Authenticated remote attackers can inject SQL statements through the ID parameter of /module/company/index.php, potentially exposing or modifying data stored in the Leave Management System database.

Affected Products

itsourcecode Leave Management System 1.0
Deployments exposing /module/company/index.php over the network
Downstream forks or customizations reusing the vulnerable company module

Discovery Timeline

2026-09-14 - CVE-2026-90796 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90796

Vulnerability Analysis

The vulnerability affects the company module of itsourcecode Leave Management System 1.0. The ID parameter received by /module/company/index.php is concatenated into a SQL statement without parameterization or input validation. An authenticated attacker with low privileges can supply crafted values that alter the intended query structure. Successful exploitation allows the attacker to read, modify, or delete records within the underlying database. Because the application handles leave and employee data, exploitation can expose personally identifiable information (PII). The exploit is publicly available according to the referenced VulDB entry.

Root Cause

The root cause is improper neutralization of user-supplied input in a downstream SQL statement, mapped to CWE-74. The ID parameter is embedded into a query string rather than bound as a prepared-statement parameter. No allowlist, type coercion, or escaping is performed before the value reaches the database driver.

Attack Vector

Exploitation occurs over the network against the HTTP interface of the application. The attacker sends a crafted request to /module/company/index.php with a malicious ID value. Authentication at a low privilege level is required, but no user interaction is needed. The attack payload uses standard SQL injection techniques such as UNION SELECT statements, boolean-based blind injection, or time-based inference to enumerate database contents. Because Leave Management System exposes this endpoint through a browser-accessible administrative area, attackers can also chain the flaw with credential reuse or weak-password attacks to reach the required privilege level. See the GitHub Issue Tracker for reporter notes and reproduction steps.

No verified proof-of-concept code is republished here. Refer to the VulDB Vulnerability #403302 entry for technical details.

Detection Methods for CVE-2026-90796

Indicators of Compromise

HTTP requests to /module/company/index.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or SELECT in the ID parameter.
Web server access logs showing unusually long query strings or repeated requests with incrementing ID values consistent with automated injection tooling.
Database error messages surfaced in HTTP responses or application logs referencing MySQL syntax errors tied to the company module.
Unexpected read or write activity against tables holding employee, leave, or credential data.

Detection Strategies

Deploy web application firewall (WAF) signatures for SQL injection patterns targeting the ID parameter of the company module.
Enable database query logging and alert on anomalous statements originating from the Leave Management System service account.
Correlate authentication events for low-privilege accounts with subsequent requests to /module/company/index.php to identify abuse of legitimate sessions.

Monitoring Recommendations

Monitor egress traffic from the application server for large data transfers that could indicate database exfiltration.
Track failed and successful logins to detect credential stuffing preceding exploitation attempts.
Baseline normal request volume to the company module and alert on deviations from expected patterns.

How to Mitigate CVE-2026-90796

Immediate Actions Required

Restrict network access to the Leave Management System to trusted internal networks or via VPN until a patched version is deployed.
Rotate credentials for any accounts with access to the company module and enforce strong password policies.
Review database audit logs for evidence of prior injection activity against /module/company/index.php.
Back up the database and application code before applying any changes or investigating suspected compromise.

Patch Information

No official vendor patch is referenced in the available advisory data. Organizations should monitor the itsourcecode site and the GitHub Issue Tracker for remediation updates. In the interim, apply source-level fixes by converting the vulnerable query to a prepared statement with bound parameters and enforcing integer type coercion on the ID value.

Workarounds

Place the application behind a WAF configured with SQL injection rulesets tuned for PHP applications.
Modify /module/company/index.php to cast the ID parameter to an integer using intval() before database use, if source-level changes are permitted.
Remove or disable the company module for environments that do not require it operationally.
Enforce least-privilege on the database account used by the application so that injection cannot access unrelated schemas.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in the ID parameter
SecRule REQUEST_URI "@contains /module/company/index.php" \
  "chain,phase:2,deny,status:403,id:1029096,\
   msg:'Potential SQLi against CVE-2026-90796'"
  SecRule ARGS:ID "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|')" \
    "t:none,t:urlDecodeUni"