CVE-2020-13525

The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTablesAjax is vulnerable to SQL injection in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-13525

ProcessMaker 3.4.11 is affected by SQL injection in the sort parameter of the reportTables_Ajax and clientSetupAjax endpoints. The vulnerability arises from unsafely constructed ORDER BY queries using the sort parameter, enabling authenticated attackers to inject SQL. TALOS describes multiple SQL...