CVE-2025-11432 is a High severity (CVSS 7.3) SQL injection in itsourcecode Leave Management System 1.0. The employid argument handled by /reset.php can change the database query. The record names no patched release, so restrict access, switch the query to prepared statements and ask the vendor for a fix.
What's affected
The record lists itsourcecode Leave Management System 1.0. The affected file is /reset.php, and the argument named in the record is employid. The weakness types are CWE-74 (injection) and CWE-89 (SQL injection). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable with no login needed.
The record says the exploit has been published. That is not the same as attacks being seen. The CVE is not in the CISA KEV catalog, and I found no advisory that reports use in the wild. Public exploit details still make scanning for the flaw easy, so exposed installs deserve attention.
No vendor advisory or fixed version is listed in the record, and I could not confirm one from the public issue report. Check the vendor's site, listed as a reference in the record, for updates.
How to check if you're exposed
First confirm you run this product. Look for the application folder on your web server and check the version in its readme, admin footer or release notes. The record only names 1.0, so treat other versions as unverified rather than safe.
Then look at the code. From the application's root directory, these commands show where the file lives and how the argument is used:
find . -name "reset.php"
grep -n "employid" reset.php
grep -rnE "(mysqli_query|mysql_query)" --include=*.php .
Any hit that builds a query by joining strings with the request value, rather than passing it as a bound parameter, is a candidate for this class of flaw.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allow list, while you decide what to do.
- Change the query that uses employid so the value is bound as a parameter. Example of the safe shape in PHP:
$stmt = $mysqli->prepare("SELECT id FROM records WHERE name = ?");
$stmt->bind_param("s", $value);
$stmt->execute();
- Give the application's database account only the rights it needs. It should not own the schema or reach other databases.
- Review logs for /reset.php and watch for odd values in employid, such as stray quotes or comment markers.
- Ask the vendor for a patch. If none is published, plan to replace the application, or maintain your own fixed copy of the code.
- Apply the same fix to every other page that builds queries from request values, since one bug often means several.
Why it matters
In an injection flaw, the application mixes untrusted text into a query. That lets whoever sends the text change the logic of the query. Depending on the database rights, the result can be data theft, tampering, or a bypass of a login check.
Because the record lists no fixed version, you cannot fix this by upgrading. The code change and the network limits above are your real controls. The weakness classes are CWE-74 and CWE-89, both well understood and cheap to prevent in new code.
Quick check
Is there a patched version of itsourcecode Leave Management?
The record names no fixed release. Check the vendor's site, and apply the code level and network controls in this post in the meantime.
Is CVE-2025-11432 exploited in the wild?
The record says an exploit has been made public, which is different from reported attacks. The CVE is not in the CISA KEV catalog, and I found no advisory saying it is exploited. Public exploit details still raise the risk for exposed sites.
Sources
- Public issue report listed in the record
- NVD record for CVE-2025-11432 (description, CVSS vector, CWEs)
To find known issues in the open source libraries behind your own projects, run the free in-browser dependency scan.
Last reviewed: 19 October 2026.
