Lucene search
PRIOn knowledge basePRION:CVE-2023-45826HistoryOct 19, 2023 - 7:15 p.m.
Sql injection
2023-10-1919:15:00
PRIOn knowledge base
www.prio-n.com
25
leantime
project management
sql injection
vulnerability
userid
parameter
post request
database
confidentiality
upgrade
nvd
Leantime is an open source project management system. A ‘userId’ variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Related
nvd
nvd
CVE-2023-45826
2023-10-19 19:15:16
cvelist
cvelist
CVE-2023-45826 Authenticated SQL Injection in leantime
2023-10-19 18:28:54
cve
cve
CVE-2023-45826
2023-10-19 19:15:16
osv
osv
CVE-2023-45826
2023-10-19 19:15:16