high8.1
CVE-2024-36428
OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.
Impact
OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Orangehrm | Orangehrm | Version 3.3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/4rdr/proofs/blob/main/info/OrangeHRM_3.3.3_SQLi_via_sortOrder.md
- https://sourceforge.net/projects/orangehrm/files/stable/3.3.3/
- https://github.com/4rdr/proofs/blob/main/info/OrangeHRM_3.3.3_SQLi_via_sortOrder.md
- https://sourceforge.net/projects/orangehrm/files/stable/3.3.3/