CVE-2025-67102 in Jorani
Summary
by MITRE • 02/17/2026
A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/11/2026
The vulnerability identified as CVE-2025-67102 represents a critical SQL injection flaw within the Jorani time tracking and leave management system. This vulnerability specifically affects versions up to v1.0.4 and resides within the alldayoffs feature, which handles day-off requests and related leave management functionality. The flaw manifests when an authenticated user manipulates the entity parameter, allowing malicious input to be directly incorporated into SQL query construction without proper sanitization or parameterization. This vulnerability falls under CWE-89 which categorizes SQL injection as a severe weakness in application security, where improper input validation enables attackers to manipulate database queries through crafted malicious input. The attack vector requires authentication, meaning that an attacker must first obtain valid credentials to exploit this vulnerability, though this does not significantly reduce the risk given that many organizations may have weak credential controls or may experience credential compromise through various attack vectors.
The technical implementation of this vulnerability stems from improper handling of user-supplied data within the application's database interaction layer. When the alldayoffs feature processes requests, it likely constructs SQL queries by concatenating the entity parameter directly into the query string rather than utilizing prepared statements or parameterized queries. This allows an attacker to inject malicious SQL fragments that can alter the intended query execution flow, potentially enabling data extraction, modification, or deletion operations. The authenticated nature of the attack means that the exploitation requires legitimate user credentials, but this access level provides sufficient privileges to execute database operations that could result in complete database compromise. This vulnerability aligns with ATT&CK technique T1213.002 which describes access to data through unauthorized database queries, and T1071.004 which covers application layer protocol manipulation.
The operational impact of this vulnerability extends beyond simple data theft, as successful exploitation could enable attackers to escalate privileges within the application, access sensitive employee information, manipulate leave records, and potentially gain persistence within the system. The alldayoffs feature likely contains sensitive employee data including leave balances, request history, and personal information, making it a valuable target for attackers seeking to compromise organizational data integrity. Database administrators should consider this vulnerability as a high-priority concern given its potential to allow unauthorized access to employee records and leave management data. Organizations utilizing Jorani versions prior to v1.0.5 should immediately implement mitigations including input validation, parameterized queries, and comprehensive code review to prevent exploitation. The vulnerability demonstrates the critical importance of proper input sanitization and query parameterization in preventing injection attacks, as highlighted by industry best practices such as those outlined in OWASP Top Ten 2021 and NIST SP 800-161.
Recommended mitigations for CVE-2025-67102 include immediate implementation of parameterized queries or prepared statements for all database interactions, particularly within the alldayoffs feature. Organizations should also deploy input validation mechanisms that sanitize all user-supplied data before processing, implementing both client-side and server-side validation to prevent malicious payloads from reaching database layers. The application should enforce proper authentication controls and implement least privilege principles to limit the impact of potential exploitation. Additionally, comprehensive logging and monitoring should be enabled to detect anomalous database query patterns that may indicate exploitation attempts. Security patches should be applied immediately upon release, and regular security assessments should be conducted to identify similar vulnerabilities throughout the application codebase. The vulnerability also underscores the importance of implementing automated security testing including dynamic application security testing and static code analysis to identify injection vulnerabilities during development lifecycle rather than after deployment.