CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-36428: OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.
Description
OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.
Classification
CVE ID: CVE-2024-36428
Affected Products
Vendor: n/a
Product: n/a
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.98% (scored less or equal to compared to others)
EPSS Date: 2025-03-14 (when was this score calculated)
References
https://github.com/4rdr/proofs/blob/main/info/OrangeHRM_3.3.3_SQLi_via_sortOrder.mdhttps://sourceforge.net/projects/orangehrm/files/stable/3.3.3/