PT-2022-23606 · Unknown · Expense Management System

Name of the Vulnerable Software and Affected Versions: Expense Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/Home/debit credit p" API endpoint. Recommendations: For Expense Management System...

Expense Management System SQL注入漏洞

Expense Management System is an expense management system. version v1.0 of Expense Management System is vulnerable to SQL injection, which stems from a lack of validation of external input SQL statements in the id parameter of its /Home/debitcreditp component. An attacker could use this...

CVE-2022-2688

A vulnerability was found in SourceCodester Expense Management System. It has been rated as critical. This issue affects the function fetchreportcredit of the file report.php of the component POST Parameter Handler. The manipulation of the argument from/to leads to sql injection. The attack may b...

Sql injection

A vulnerability was found in SourceCodester Expense Management System. It has been rated as critical. This issue affects the function fetchreportcredit of the file report.php of the component POST Parameter Handler. The manipulation of the argument from/to leads to sql injection. The attack may b...

CVE-2022-2688 SourceCodester Expense Management System POST Parameter report.php fetch_report_credit sql injection

A vulnerability was found in SourceCodester Expense Management System. It has been rated as critical. This issue affects the function fetchreportcredit of the file report.php of the component POST Parameter Handler. The manipulation of the argument from/to leads to sql injection. The attack may b...

CVE-2022-2688

CVE-2022-2688 affects SourceCodester Expense Management System. The vulnerability resides in the POST Parameter Handler, specifically the fetch_report_credit function in report.php, where the from/to argument is manipulated, leading to a SQL injection. It is exploitable remotely and impacts confi...

Expense Management System SQL注入漏洞

Expense Management System is an expense management system by Carlo Montero Personal Developer. SourceCodester Expense Management System suffers from a SQL injection vulnerability that originates in the report.php component where the POST parameter handler of the fetchreportcredit function operate...

EGavilan Media Expense-Management-System SQL Injection Vulnerability

EGavilan Media Expense-Management-System is a simple expense management system from EGavilan Media, Inc. An SQL injection vulnerability exists in EGavilan Media Expense-Management-System version 1.0, which stems from vulnerability to SQL injection via / expenseaction.php for SQL injection attacks...

CVE-2021-44098

EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expenseaction.php. This allows a remote attacker to compromise Application SQL database...

CVE-2021-44098

EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expenseaction.php. This allows a remote attacker to compromise Application SQL database...

CVE-2021-44098

EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expenseaction.php. This allows a remote attacker to compromise Application SQL database...

Sql injection

EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expenseaction.php. This allows a remote attacker to compromise Application SQL database...

EGavilan Media Expense-Management-System SQL注入漏洞

EGavilan Media Expense-Management-System is a simple expense management system from EGavilan Media, Inc. An SQL injection vulnerability exists in EGavilan Media Expense-Management-System version 1.0, which stems from vulnerability to SQL injection via / expenseaction.php for SQL injection attacks...

CVE-2021-44098

EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expenseaction.php. This allows a remote attacker to compromise Application SQL database...

CVE-2021-44098

EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expense_action.php, allowing a remote attacker to compromise the application SQL database. The vulnerability is described across multiple sources as an SQL injection flaw in the Expense-Management-System, with no rem...

Dolibarr Stored Cross-site Scripting in expensereport/card.php

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

Dolibarr SQL injection via the integer parameters qty and value_unit

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and valueunit...

GHSA-H34Q-878W-W96R Dolibarr SQL injection via the integer parameters qty and value_unit

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and valueunit...

Unrestricted Upload of File with Dangerous Type

Description In recent Crater version bed05fc2 tag: 6.0.4 privileged user can upload PHP file as expense receipt. Proof of Concept POST /api/v1/expenses/59/upload/receipts HTTP/1.1 Host: 172.17.0.1:8888 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:98.0 Gecko/20100101 Firefox/98.0 Accept: /...

Authentication Bypass

bytefury/crater is vulnerable to authentication bypass. The vulnerability exists due to improper user validation handling in payment method delete which allows an unauthenticated user to all expense receipts uploaded to a company...