未評価
SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuz...
CVE-2020-29437
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint.
参照URL
- advisory github.com
- advisory github.com
- patch github.com
- report horizon3.ai