CVE-2022-34132 in Jorani
Summary
by MITRE • 06/28/2022
Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/30/2026
The vulnerability CVE-2022-34132 represents a critical SQL injection flaw in Jorani version 1.0, specifically within the application/controllers/Leaves.php file where the id parameter is improperly handled. This vulnerability falls under CWE-89 which categorizes SQL injection as a severe input validation weakness that allows attackers to manipulate database queries through malicious input. The affected parameter resides in the leave management functionality of this human resources application, making it a prime target for attackers seeking to compromise employee data and organizational records.
The technical exploitation of this vulnerability occurs when an attacker crafts malicious input through the id parameter that gets directly incorporated into SQL queries without proper sanitization or parameterization. This allows unauthorized individuals to execute arbitrary SQL commands against the underlying database, potentially gaining read access to sensitive employee information, leave records, user credentials, or even escalating privileges within the system. The vulnerability exists because the application fails to implement proper input validation and query parameterization techniques, creating an exploitable path for database manipulation attacks.
Operationally, this vulnerability poses significant risks to organizations using Jorani v1.0 for human resources management. Attackers could extract confidential employee data including personal information, leave balances, attendance records, and potentially administrative credentials. The impact extends beyond data theft to include potential system compromise, data integrity violations, and compliance violations under data protection regulations such as GDPR or HIPAA. Given that this affects leave management systems, attackers could also manipulate leave records to enable fraudulent time-off claims or disrupt legitimate HR processes.
Organizations should immediately implement multiple layers of mitigation strategies to address this vulnerability. The primary recommendation involves applying the vendor-supplied patch or upgrading to a patched version of Jorani, as this represents the most effective solution. Additionally, implementing proper input validation and parameterized queries in the affected controller file is essential. Network-level protections such as web application firewalls should be configured to detect and block SQL injection attempts, while regular security assessments should be conducted to identify similar vulnerabilities. This vulnerability aligns with ATT&CK technique T1190 which describes exploitation of vulnerabilities in applications, and represents a common vector for initial access and privilege escalation in target environments.