Threats affecting pkg:github/Jorani

Jorani versions before 1.0.4 have a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime, and exportEmployees actions. This flaw allows any authenticated user to export sensitive HR data, including employee names, emails, contracts, managers, and leave and overtime records. The vulnerability does not require user interaction and has a medium severity score of 4.3. No patch or remediation details are provided in the available data.

Jorani versions prior to 1.0.4 have an insecure direct object reference vulnerability that allows authenticated users to access and manipulate other employees' leave and overtime requests. This occurs because authorization is based solely on operation names, enabling attackers to supply numeric request IDs to various functions to view, modify, or delete requests and read leave history.

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get_headers() and fopen() for server-side request forgery against internal hosts.