Unrated severityNVD Advisory· Published Nov 12, 2020· Updated Aug 4, 2024
CVE-2020-26805
CVE-2020-26805
Description
In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2. In this POST request, "employeeNumId" parameter is affected by SQLi vulnerability. Attacker can inject SQL commands into query, read data from database or write data into the database.
Affected products
2- Sentrifugo/Sentrifugodescription
- Range: =3.2
Patches
Vulnerability mechanics
References
1- fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-sqli.htmlmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.