| Package | Affected versions | Patched versions |
|---|---|---|
| orangehrm | = 2.7.1 |
Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to (1) viewCustomers, (2) viewPayGrades, or (3) viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site request forgery (CSRF) attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free