search

sapplica / sentrifugo

Sentrifugo is a FREE and powerful Human Resource Management System (HRMS) that can be easily configured to meet your organizational needs.
http://www.sentrifugo.com/
GNU General Public License v3.0
488 stars 428 forks source link

Multiple Blind SQL injection on sentrifugo 3.2 version #337

Open minhnb11 opened 4 years ago

minhnb11 commented 4 years ago

Blind sqlinjection on /sentrifugo/index.php/holidaygroups/add param: id. payload: id=0'XOR(if(now()=sysdate(),sleep(9),0))XOR'Z&groupname=a&description=thisistest&submit=Save

many others link also vulnerable too, example: /sentrifugo/index.php/wizard/configureservicerequest param: category_id /sentrifugo/index.php/dashboard/update param: user_id ... please fix it.

NicoleG25 commented 4 years ago

It appears CVE-2020-10218 was assigned to this issue.