GitHub Advisoryadvisory · Packagist

GHSA-v4q9-437p-mhpg Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)

HIGH Published 2025-02-21 Modified 2025-02-21 Official page ↗
Ecosystem
Packagist
Packages
leantime/leantime
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79, CWE-89
Reviewed
2025-02-21

Affected packages

• Packagist leantime/leantime: < 3.3 → fixed in 3.3

Description

Summary A cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not include any validation or sanitization of the $_GET["id"] parameter. As a result, it directly incorporates the user-supplied value into the source path without any checks.

Related

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References