CVE-2020-26805

In Sentrifugo 3.2, admin can edit employee's informations via this endpoint -- /sentrifugo/index.php/empadditionaldetails/edit/userid/2. In this POST request, "employeeNumId" parameter is affected by SQLi vulnerability. Attacker can inject SQL commands into query, read data from database or write...

CVE-2020-26805: Improper Neutralization of Special Elements used in an SQL Command

In Sentrifugo 3.2, admin can edit employee's informations via this endpoint -- /sentrifugo/index.php/empadditionaldetails/edit/userid/2. In this POST request, "employeeNumId" parameter is affected by SQLi vulnerability. Attacker can inject SQL commands into query, read data from database or write...

PT-2020-16493

Name of the Vulnerable Software and Affected Versions Sentrifugo version 3.2 Description The issue allows an admin to edit employee information via the "/sentrifugo/index.php/empadditionaldetails/edit/userid/2" endpoint. The employeeNumId parameter in this POST request is affected by a SQL...