| Package | Affected versions | Patched versions |
|---|---|---|
| sentrifugo | = 3.2 |
In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2. In this POST request, "employeeNumId" parameter is affected by SQLi vulnerability. Attacker can inject SQL commands into query, read data from database or write data into the database.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free