CVE-2024-36428

Description

OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/4rdr/proofs/blob/main/info/OrangeHRM_3.3.3_SQLi_via_sortOrder.md ↗
• https://sourceforge.net/projects/orangehrm/files/stable/3.3.3/ ↗