CVE-2023-2681

An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter, managing to extract arbritary information from the...

Jorani SQL Injection Vulnerability

Jorani is a leave management system developed by Benjamin BALET, an individual developer in France. It is designed to provide small organizations with a simple workflow for leave and overtime requests. A SQL injection vulnerability exists in Jorani version 1.0.0 that originates from allowing an...

CVE-2023-2681: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter, managing to extract arbritary information from the...

PT-2018-13286

Name of the Vulnerable Software and Affected Versions Jorani version 0.6.5 Description An issue allows a user without permissions to read and modify sensitive information from the database via the startdate or enddate parameter to leaves/validate. This is due to SQL Injection, which is error-base...

CVE-2018-15918: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Jorani 0.6.5. SQL Injection error-based allows a user of the application without permissions to read and modify sensitive information from the database used by the application via the startdate or enddate parameter to leaves/validate...