CVE-2024-35469

CVE-2024-35469 提出者: Kha Do 人事管理システム 1.0 脆弱性 SQLインジェクション 説明 SourceCodester 人事管理システム 1.0 の /hrm/user/ における SQLインジェクションの脆弱性により、攻撃者はpasswordパラメータを介して任意のSQLコマンドを実行できます。 影響を受けるコンポーネント /hrm/user/ 影響 攻撃者はペイロード 'or'1'='1 を使用して、認証情報なしで管理者アカウントでログインできます。 POC 匿名でログイン 脆弱性を含むソースコード 動画...

CVE-2024-34223

PHPとMySQLを使用した人事管理システムプロジェクト フリーソースコード 投稿者: Kha Do 脆弱性 安全でない権限 説明 SourceCodester Human Resource Management System 1.0の/hrm/leaverequest.phpにおける安全でない権限の脆弱性により、攻撃者が休暇申請を承認または拒否できる可能性があります。 影響を受けるコンポーネント パスURL: /hrm/leaverequest.php パラメータ: ?msg= 、?id= 影響 通常ユーザーが休暇申請を自己承認または拒否できるため、許可されていない操作が可能です。 i...

CVE-2024-34221

PHPとMySQLを使用した人事管理システムプロジェクト フリーソースコード 提出者: Kha Do 脆弱性 安全でない権限 説明 SourceCodester Human Resource Management System 1.0の/hrm/controller/ccity.php?positionedit=に安全でない権限の脆弱性が存在し、攻撃者が一般ユーザーには許可されていない機能にアクセスできる可能性があります。 影響を受けるコンポーネント パスURL: /hrm/controller/ccity.php?positionedit= パラメータ: position.php 影響...

CVE-2024-34222

Human Resource Management System 1.0 提出者: Kha Do 脆弱性 SQLインジェクション 説明 SourceCodester Human Resource Management System 1.0 の /hrm/country.php における SQL インジェクションの脆弱性により、攻撃者は searccountry パラメータを介して任意の SQL コマンドを実行できる可能性があります。 影響を受けるコンポーネント パス URL: /hrm/country.php パラメータ: & searccountry=inject here 影響...

EUVD-2024-34700

Malicious code in bioql PyPI...

CVE-2023-3391

A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file detailview.php. The manipulation of the argument employeeid leads to sql injection. The attack can be initiated remotely. The...

CVE-2024-35469

A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL commands via the password parameter...

CVE-2024-35468

CVE-2024-35468 affects SourceCodester Human Resource Management System v1.0. A SQL injection flaw exists in the /hrm/index.php endpoint, exploitable through the password parameter to execute arbitrary SQL commands. Root cause: improper handling/sanitization of input to the SQL query in that API p...

CVE-2024-34221

Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation...

CVE-2024-34220

Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the 'leave' parameter...

CVE-2024-34223

Insecure permission vulnerability in /hrm/leaverequest.php in SourceCodester Human Resource Management System 1.0 allow attackers to approve or reject leave ticket...

CVE-2024-34220

CVE-2024-34220 affects Sourcecodester Human Resource Management System 1.0 and is described as a SQL Injection via the 'leave' parameter. Public PoC/exploit code exists (e.g., on GitHub), showing parameterized input being unsafely handled and allowing sleep-based timing tricks. Red Hat/PT-Securit...

Sql injection

A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file detailview.php. The manipulation of the argument employeeid leads to sql injection. The attack can be initiated remotely. The...

CVE-2022-4278

A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /hrm/employeeadd.php. The manipulation of the argument empid leads to sql injection. The attack may be initiated remotely. The...

CVE-2022-4279

A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown function of the file /hrm/employeeview.php. The manipulation of the argument search leads to cross site scripting. It is possible to launch the attack remotely...

CVE-2022-4278

A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /hrm/employeeadd.php. The manipulation of the argument empid leads to sql injection. The attack may be initiated remotely. The...

CVE-2022-4273

A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the component Content-Type Handler. The manipulation of the argument pfimg leads to...

Out-of-bounds

A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the component Content-Type Handler. The manipulation of the argument pfimg leads to...

CVE-2022-4279 SourceCodester Human Resource Management System employeeview.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown function of the file /hrm/employeeview.php. The manipulation of the argument search leads to cross site scripting. It is possible to launch the attack remotely...

CVE-2022-4273 SourceCodester Human Resource Management System Content-Type employee.php unrestricted upload

A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the component Content-Type Handler. The manipulation of the argument pfimg leads to...