CVE-2023-45826 (leantime)

Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

api app attacker beta class confidentiality cve database domain dumping exploit files information injection issue management open source php project project management repositories request send sql sql injection system variable version vulnerability