CVE-2025-67102: Jorani SQL Injection Vulnerability

CVE-2025-67102 Overview

A SQL injection vulnerability exists in the alldayoffs feature of Jorani, an open-source leave management system, affecting versions up to and including v1.0.4. This vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the entity parameter, potentially leading to unauthorized data access, modification, or complete database compromise.

Critical Impact

Authenticated attackers can exploit this SQL injection flaw to extract sensitive employee data, modify leave records, escalate privileges within the application, or potentially gain full control over the underlying database server.

Affected Products

• Jorani Leave Management System versions up to v1.0.4
• Installations using the alldayoffs feature with insufficient input validation
• Self-hosted Jorani deployments with database backend access

Discovery Timeline

• 2026-02-17 - CVE CVE-2025-67102 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-67102

Vulnerability Analysis

This SQL injection vulnerability resides within the alldayoffs feature of the Jorani application, which manages employee leave and day-off requests. The vulnerability stems from improper handling of the entity parameter, where user-supplied input is directly incorporated into SQL queries without adequate sanitization or parameterization.

An authenticated attacker with access to the alldayoffs functionality can craft malicious input containing SQL metacharacters and commands. When the vulnerable code processes this input, the injected SQL statements are executed with the same privileges as the application's database user. This can result in unauthorized read access to sensitive data such as employee personal information, leave balances, and organizational hierarchy, as well as write access to modify or delete records.

The attack requires authentication to the Jorani system, meaning the attacker must possess valid user credentials. However, once authenticated, even a user with minimal privileges can potentially escalate their access through database manipulation.

Root Cause

The root cause of this vulnerability is the failure to properly sanitize or parameterize user input in the entity parameter before including it in SQL queries. The alldayoffs feature directly concatenates user-supplied data into SQL statements rather than using prepared statements or parameterized queries, which are the industry-standard defenses against SQL injection attacks.

Attack Vector

The attack vector involves an authenticated user submitting specially crafted input through the entity parameter within the alldayoffs feature. The attacker manipulates HTTP requests to inject SQL syntax that alters the intended query logic.

A typical exploitation scenario involves modifying the entity parameter value to include SQL commands such as UNION-based queries to extract data from other tables, boolean-based blind injection to enumerate database contents, or stacked queries to execute administrative commands. The vulnerability requires network access to the Jorani application and valid authentication credentials.

For technical exploitation details, refer to the Helx Blog Advisory on Jorani which provides additional context on this vulnerability.

Detection Methods for CVE-2025-67102

Indicators of Compromise

• Unusual SQL error messages in application logs referencing the alldayoffs endpoint
• Anomalous database queries containing UNION, SELECT, or other SQL keywords within the entity parameter
• Unexpected database access patterns or queries executing outside normal application behavior
• Evidence of data exfiltration or unauthorized modifications to leave management records

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in request parameters
• Enable database query logging and monitor for suspicious query structures targeting leave management tables
• Deploy application-level intrusion detection to identify malformed requests to the alldayoffs feature
• Configure SentinelOne Singularity to monitor for anomalous process behavior and database access patterns

Monitoring Recommendations

• Monitor HTTP request logs for the alldayoffs endpoint with special attention to the entity parameter
• Enable verbose database logging to capture all queries executed by the Jorani application
• Set up alerts for SQL syntax errors or unusual query execution times that may indicate injection attempts
• Review authentication logs to correlate suspicious SQL activity with specific user accounts

How to Mitigate CVE-2025-67102

Immediate Actions Required

• Upgrade Jorani to a patched version that addresses the SQL injection vulnerability
• Restrict access to the alldayoffs feature to only essential personnel until patching is complete
• Implement Web Application Firewall rules to filter SQL injection attempts targeting the entity parameter
• Review database access logs for signs of prior exploitation attempts

Patch Information

Organizations should update their Jorani installations to the latest available version. Consult the GitHub Jorani Repository for the most recent releases and security patches. Administrators should review release notes for security-related fixes and ensure their deployment includes all recommended updates.

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection detection rules in front of the Jorani application
• Implement network segmentation to limit database server exposure from the web application tier
• Apply the principle of least privilege to the Jorani database user to minimize potential damage from successful exploitation
• Consider temporarily disabling the alldayoffs feature if not business-critical until a patch is applied

For environments where immediate patching is not feasible, consider implementing input validation at the web server or reverse proxy level to filter potentially malicious entity parameter values. Regular security audits of the Jorani codebase and database configuration are recommended to identify similar vulnerabilities.