PT-2014-2229

Name of the Vulnerable Software and Affected Versions OrangeHRM versions prior to 2.7 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the hspSummaryId parameter to the "plugins/ajaxCalls/haltResumeHsp.php" endpoint, specifically...

CVE-2012-1506: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from...