Threat Intelligence Database

Jorani versions prior to 1.0.4 have a missing authorization vulnerability in the Contracts::import() function. This flaw allows any authenticated user to import days off into any contract by submitting a contract ID and arbitrary URL via POST. The vulnerability enables overwriting of non-working-day calendars and can be abused for server-side request forgery (SSRF) through functions like get_headers() and fopen(). The CVSS score is 5.4, indicating a medium severity issue.

Jorani versions before 1.0.4 have a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime, and exportEmployees actions. This flaw allows any authenticated user to export sensitive HR data, including employee names, emails, contracts, managers, and leave and overtime records. The vulnerability does not require user interaction and has a medium severity score of 4.3. No patch or remediation details are provided in the available data.

Jorani versions prior to 1.0.4 have an insecure direct object reference vulnerability that allows authenticated users to access and manipulate other employees' leave and overtime requests. This occurs because authorization is based solely on operation names, enabling attackers to supply numeric request IDs to various functions to view, modify, or delete requests and read leave history.