---
id: 10268
title: "CVE-2020-29437: Authenticated SQL Injection in OrangeHRM < 4.6.0.1"
cve: CVE-2020-29437
source_domain: horizon3.ai
source_url: "https://horizon3.ai/attack-research/disclosures/cve-2020-29437-authenticated-sql-injection-in-orangehrm-4-6-0-1/"
published_at: "2021-01-05T19:13:52Z"
tags: ["vulnerability-research", "sql-injection", "horizon3", "orangehrm", "cve-2020-29437"]
phying_url: "https://phying.com/item/10268"
lang: en
---

# CVE-2020-29437: Authenticated SQL Injection in OrangeHRM < 4.6.0.1

## Summary

OrangeHRM is software for Human Resource Management (HRM). In a routine audit of the open source version of OrangeHRM, we discovered a SQL injection…

## Intelligence Metadata

- **Sources:** horizon3.ai
- **CVE:** CVE-2020-29437
- **Published:** 2021-01-05T19:13:52Z
- **Original:** https://horizon3.ai/attack-research/disclosures/cve-2020-29437-authenticated-sql-injection-in-orangehrm-4-6-0-1/
- **Phying News:** https://phying.com/item/10268