CVE-2020-26805

In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2

published November 12, 2020

CVSS
—
EPSS
2%
Percentile
74.1
In the wild
Unconfirmed
What it is

In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2. In this POST request, "employeeNumId" parameter is affected by SQLi vulnerability. Attacker can inject SQL commands into query, read data from database or write data into the database.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01505 · 74.1th percentile
Published
2020-11-12T18:52Z
EPSS history
Timeline
  • 12 NOV 18:52Z
    In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2
    cvelistv5