High severity7.2NVD Advisory· Published Nov 12, 2020· Updated Jun 17, 2026
CVE-2020-26805
CVE-2020-26805
Description
In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2. In this POST request, "employeeNumId" parameter is affected by SQLi vulnerability. Attacker can inject SQL commands into query, read data from database or write data into the database.
Affected products
3- cpe:2.3:a:sapplica:sentrifugo:3.2:*:*:*:*:*:*:*
- Sentrifugo/Sentrifugodescription
- Range: = 3.2
Patches
Vulnerability mechanics
References
1- fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-sqli.htmlnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.