CVE-2012-5367

CVE-2012-5367 describes multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1, specifically affecting the 'sortField' parameter in administrative views. This vulnerability allows remote authenticated administrators to execute arbitrary SQL commands, potentially via Cross-Site Request Forgery (CSRF) attacks. The CVSS score of 6.0 indicates a medium severity, with an attack vector over the network, medium attack complexity, and partial impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.