CVE-2012-5367: Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to...

Security readout for executives and security teams

OrangeHRM 2.7.1 RC 1 reportedly allowed administrator-level requests to inject SQL through sorting fields in several admin pages. A malicious site could potentially abuse an authenticated administrator’s browser through CSRF. This matters because arbitrary database queries can expose, alter, or delete HR data if the vulnerable release is still in use. Exposure is most likely in legacy OrangeHRM 2.7.1 RC 1 installations, especially admin interfaces reachable by browsers or networks where administrators work. The bundle’s affected-product metadata is incomplete, so inventory confirmation is required. Prioritize if OrangeHRM is used to store employee or HR records. The affected release is old, but arbitrary SQL in HR software can create confidentiality, integrity, and compliance impact. If not present in inventory, document non-exposure. Mitigation focus: Check OrangeHRM vendor guidance for fixed or supported replacement versions.; Remove or upgrade any OrangeHRM 2.7.1 RC 1 deployment.; Restrict administrative interfaces to trusted networks and users..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.