NetSight
IP …
medium6.5Public exploit code

CVE-2012-1506

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute ar…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from third party information.

Affected products

VendorProductAffected versions
OrangehrmOrangehrm
through 2.6.12.1
Versions 2.6, 2.6.0, 2.6.0.1, 2.6.1, 2.6.2

Weakness classification

CWE-89

References