CVE-2025-11432: itsourcecode Leave Management System reset.php SQL injection
A SQL injection flaw (CWE-89) in the reset.php file of itsourcecode Leave Management System 1.0 allows a remote party to manipulate the employid argument. NVD rates it critical with a CVSS 3.1 score of 9.8, while several VulDB and CNA scores are lower. The record lists no fixed version and describes the exploit as publicly available.
Overview
CVE-2025-11432 is an SQL injection weakness (CWE-89) reported in itsourcecode Leave Management System 1.0. According to the record, the flaw is in an unspecified function of the /reset.php file and is triggered through the employid argument.
Impact
SQL injection can allow an attacker to influence database queries built by the application. The record describes the attack as performable remotely. NVD's CVSS 3.1 vector reports high impact to confidentiality, integrity and availability, but the actual consequences depend on the database configuration and the application, which the record does not detail.
Affected products and versions
- Itsourcecode Leave Management System, version 1.0, is the only affected version listed in the record.
- The record does not list other affected versions or a fixed version.
Scores differ across sources:
- NVD: CVSS 3.1, score 9.8, critical.
- VulDB: CVSS 3.1 score 7.3, CVSS 4.0 score 6.9, CVSS 3.0 score 7.3, CVSS 2.0 score 7.5.
- CNA (cna@vuldb.com): CVSS 4.0 score 5.5, CVSS 3.1 score 7.3, CVSS 2.0 score 7.5.
Exploitation status
The record states that the exploit is publicly available and might be used. The CISA KEV catalog does not list this CVE, so no confirmed active exploitation is recorded in the sources consulted. The SSVC exploitation field is set to proof-of-concept, which points to public exploit material rather than observed attacks.
Remediation and mitigation
- The record contains no vendor fix. Check the vendor website or contact the vendor for an updated release.
- Until a fix is confirmed, restrict access to the reset functionality to trusted networks and users.
- Developers should use parameterized queries and validate the employid input on the server side.
- If the application is reachable from untrusted networks, treat it as exposed while no fix is confirmed.
Detection guidance
- Review web server and application logs for unusual or malformed values in the employid parameter on requests to reset.php.
- Monitor database error messages and unexpected query behavior tied to the application.
- Alert on bulk or repeated password reset activity originating from a single source.
Limitations of the available information
The record does not describe the vulnerable code path in detail and does not list a fixed version. The NVD entry indicates no privileges are required, while a VulDB entry carries a 'Permissions Required' tag, so whether authentication is needed remains unconfirmed. Scores differ between NVD, VulDB and the CNA. The record includes an EPSS probability of 0.00478, which is shown here without further interpretation.
Frequently asked questions
Which versions of itsourcecode Leave Management System are affected by CVE-2025-11432?
The record lists version 1.0 as the affected version. It does not list other versions or a fixed version.
Is this vulnerability being actively exploited?
The CVE is not listed in the CISA KEV catalog in the record, and the sources consulted do not confirm active exploitation. The record does say a public exploit is available.
What should administrators do now?
No vendor fix is listed in the record. Restrict access to the reset functionality, check the vendor for updates, and review logs for unusual employid values.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.