CVE-2025-67102: 
Jorani vulnerability analysis and mitigation

CVE-2025-67102 is a SQL injection vulnerability in the alldayoffs feature of Jorani, an open-source Leave and Overtime Management System. It affects Jorani versions up to and including v1.0.4, allowing an authenticated attacker to execute arbitrary SQL commands via the entity parameter. The vulnerability was published on February 17, 2026, and carries a CVSS v3.1 base score of 7.6 (High) (Feedly, Helx Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), rooted in insufficient input sanitization of the entity parameter within the alldayoffs feature (Feedly). An authenticated attacker can craft a malicious HTTP request containing SQL metacharacters in the entity parameter, which are passed unsanitized to the underlying MySQL database query. Exploitation requires a valid user account (low privileges), no user interaction, and is performed over the network with low attack complexity. A proof-of-concept exploit has been published by Helx (Helx Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary SQL commands against the Jorani database backend, resulting in high confidentiality impact (unauthorized access to sensitive HR and employee data), low integrity impact (modification of database records such as leave balances or approvals), and low availability impact (potential disruption of database operations) (Feedly). The scope is limited to the affected system, but data exfiltration of employee records, credentials, or organizational structure data stored in the database is a realistic outcome. Depending on database user privileges, more severe actions such as reading local files or executing OS commands may also be possible.

A proof-of-concept exploit is publicly available via Helx's security advisory, added to exploit tracking on April 3, 2026 (Helx Advisory). There is no current evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), indicating a currently low probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify Jorani instances (v1.0.4 or earlier) exposed on the network or internet using search engines, Shodan, or internal asset inventories. Look for the default login page at the application root.
2. Authentication: Log in with any valid low-privileged user account (e.g., a standard employee account). Default credentials (jdoe/jdoe) may be present on misconfigured installations (Jorani GitHub).
3. Locate the vulnerable endpoint: Navigate to the alldayoffs feature within the application, which generates reports on all-day leave/off requests.
4. Inject malicious payload: Manipulate the entity parameter in the HTTP request (GET or POST) to the alldayoffs endpoint, injecting SQL syntax such as ' OR 1=1-- or time-based blind injection payloads (e.g., ' AND SLEEP(5)--) to confirm vulnerability.
5. Extract data: Use tools like sqlmap targeting the entity parameter to enumerate databases, tables, and extract sensitive records (employee data, credentials, leave records).
6. Escalate if possible: If the database account has elevated privileges (e.g., FILE privilege in MySQL), attempt to read sensitive server files or write web shells for further access (Helx Advisory).

• Network: Unusual or repeated HTTP requests to the alldayoffs endpoint containing SQL metacharacters (', --, OR, UNION, SLEEP) in the entity parameter; unexpected outbound connections from the web/database server.
• Logs: Web server access logs showing requests to the alldayoffs route with anomalous entity parameter values (e.g., URL-encoded quotes, SQL keywords); database error messages logged from the Jorani application related to malformed SQL queries.
• Database: Unexpected queries in MySQL general query log containing UNION SELECT, SLEEP(), INFORMATION_SCHEMA, or other SQL injection patterns originating from the Jorani application account.
• File System: Unexpected new PHP files or web shells in the Jorani web root directory (if FILE privilege was abused to write files).
• Process: Unusual child processes spawned by the web server process (e.g., bash, sh, curl) if OS-level command execution was achieved via SQL injection (Helx Advisory).

No official patch version has been confirmed in available data; organizations should monitor the Jorani GitHub repository and the Releases page for a patched version and upgrade as soon as one is available. In the interim, implement network segmentation to restrict access to the Jorani application to trusted users only, and enforce strong, unique credentials for all accounts. Apply database least-privilege principles by ensuring the Jorani database account has only the minimum required permissions (SELECT, INSERT, UPDATE, DELETE — no FILE or SUPER privileges). Monitor database activity logs for anomalous SQL patterns and consider deploying a Web Application Firewall (WAF) with SQL injection detection rules in front of the Jorani instance (Feedly).

The vulnerability was documented in a security advisory published by Helx, which also provided the proof-of-concept exploit (Helx Advisory). Red Hat has tracked the CVE in their security database (Red Hat CVE). No significant broader media coverage, vendor statements from the Jorani project, or notable social media discussion has been identified at this time.