Multiple vulnerabilities in OrangeHRM
| Advisory ID: | HTB23080 |
| Product: | OrangeHRM |
| Vendor: | OrangeHRM Inc. |
| Vulnerable Versions: | 2.7 RC and probably prior |
| Tested Version: | 2.7 RC |
| Advisory Publication: | March 7, 2012 [without technical details] |
| Vendor Notification: | March 7, 2012 |
| Vendor Fix: | April 24, 2012 |
| Public Disclosure: | May 9, 2012 |
| Latest Update: | May 2, 2012 |
| Vulnerability Type: | SQL Injection [CWE-89]
Cross-Site Scripting [CWE-79] |
| CVE References: | CVE-2012-1506
CVE-2012-1507 |
| Risk Level: | Medium |
|  |
| CVSSv2 Base Scores: | 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
|
Advisory Details: |
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform SQL Injection and Cross-Site Scripting (XSS) attacks.
1) SQL Injection in OrangeHRM: CVE-2012-1506
1.1 Input passed via the "hspSummaryId" GET parameter to /plugins/ajaxCalls/haltResumeHsp.php is not properly sanitised before being used in SQL "UPDATE" query. This vulnerability can be exploited by time-based blind SQL injection techniques to reveal sensitive information from the database.
The following PoC (Proof of Concept) will cause a delay of the script execution if MySQL server version is 5.*:
http://[host]/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus=1&empId=2&hsp SummaryId=%27%20OR%20%28select%20IF%28%28select%20mid%28version%28%29,1,1%29 %29=5,%28select%20BENCHMARK%281000000,ENCODE%28%22hello%22,%22goodbye%22%29% 29%29,%272%27%29%29%20--%202
Successful exploitation of this vulnerability requires attacker to be registered and logged-in.
2) Multiple Cross-Site Scripting (XSS) in OrangeHRM: CVE-2012-1507
2.1 Input passed via the "newHspStatus" GET parameter to /plugins/ajaxCalls/haltResumeHsp.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
The following PoC (Proof of Concept) demonstrate the vulnerability:
http://[host]/plugins/ajaxCalls/haltResumeHsp.php?hspSummaryId=1&newHspStatu s=1%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E&empId=1
2.2 Input passed via the "sortOrder" GET parameter to /templates/hrfunct/emppop.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
The following PoC (Proof of Concept) demonstrate the vulnerability:
http://[host]/templates/hrfunct/emppop.php?reqcode=1&sortOrder1=%22%3E%3Cscr ipt%3Ealert%28document.cookie%29;%3C/script%3E
2.3 Input passed via the "uri" GET parameter to /index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a administrator's browser session in context of affected website.
The following PoC (Proof of Concept) demonstrate the vulnerability:
http://[host]/index.php?uri=%22%3E%3C/iframe%3E%3Cscript%3Ealert%28document. cookie%29;%3C/script%3E |
- GDPR & PCI DSS Test
- Website CMS Security Test
- CSP & HTTP Headers Check
- WordPress & Drupal Scanning
Try For Free
Solution: |
Upgrade to OrangeHRM 2.7 Stable Release.
More Information:
http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/ |
| |
References: |
[1] High-Tech Bridge Advisory HTB23080 - https://www.immuniweb.com/advisory/HTB23080 - Multiple vulnerabilities in OrangeHRM.
[2] OrangeHRM - http://www.orangehrm.com - OrangeHRM is the world’s most popular Open Source Human Resource Management Software (HRMS) with over 1,000,000 users globally.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. |
|
Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
