CVE-2024-35468

CVE-2024-35468 提出者: Kha Do 人事管理システム 1.0 脆弱性 SQLインジェクション 説明 SourceCodester 人事管理システム 1.0 の /hrm/index.php における SQL インジェクションの脆弱性により、攻撃者が password パラメータを介して任意の SQL コマンドを実行できる可能性があります。 影響を受けるコンポーネント /hrm/index.php 影響 攻撃者はペイロード 'or'1'='1 を使用して、認証情報なしで管理者アカウントにログインできます。 POC 匿名ログイン 脆弱性を含むソースコード 動画...

CVE-2024-34220

PHP 및 MySQL로 제작된 인사 관리 시스템 프로젝트 무료 소스 코드 제출자: Kha Do 공급업체: SourceCodester 영향을 받는 및/또는 수정된 버전 취약한 파일 applyleave.php 문제 유형 취약점 유형 SQL 인젝션 영향 공격자는 이 취약점을 악용하여 데이터베이스 권한을 획득할 수 있으며, 이로 인해 데이터베이스에 저장된 대량의 데이터가 유출될 수 있습니다. 상대방의 데이터베이스에 DBA 권한이 있는 경우 서버 호스트 권한을 획득할 수도 있습니다. 개념 증명PoC 페이로드 POST...

CVE-2022-3497

A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been classified as problematic. Affected is an unknown function of the component Master List. The manipulation of the argument city/state/country/position leads to cross site scripting. It is possible to laun...

Improper access control

A vulnerability was found in SourceCodester Human Resource Management System 1.0 and classified as critical. This issue affects some unknown processing of the file employeeadd.php of the component Admin Panel. The manipulation leads to improper access controls. The attack may be initiated remotel...

Command injection

A vulnerability classified as critical was found in SourceCodester Human Resource Management System 1.0. This vulnerability affects unknown code of the component Profile Photo Handler. The manipulation of the argument parameter leads to os command injection. The attack can be initiated remotely...

PT-2022-22439 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A problematic issue has been found in the Add Employee Handler component, where the manipulation of the First Name/Middle Name/Last Name argument leads to cross-site...

CVE-2022-3492

CVE-2022-3492 concerns SourceCodester Human Resource Management System 1.0, specifically the Profile Photo Handler component. The core issue is the manipulation of an argument parameter that enables an OS command injection, with a remote attack surface. Several connected sources reiterate the vul...