Stay in Touch

Application security insights and invitations to exclusive events in your inbox


Your data will stay confidential Private and Confidential

Multiple vulnerabilities in OrangeHRM

Advisory ID:HTB23080
Product:OrangeHRM
Vendor: OrangeHRM Inc.
Vulnerable Versions:2.7 RC and probably prior
Tested Version:2.7 RC
Advisory Publication:March 7, 2012 [without technical details]
Vendor Notification:March 7, 2012
Vendor Fix:April 24, 2012
Public Disclosure:May 9, 2012
Latest Update:May 2, 2012
Vulnerability Type:SQL Injection [CWE-89]
Cross-Site Scripting [CWE-79]
CVE References:CVE-2012-1506
CVE-2012-1507
Risk Level:Medium
CVSSv2 Base Scores:6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform SQL Injection and Cross-Site Scripting (XSS) attacks.

1) SQL Injection in OrangeHRM: CVE-2012-1506
1.1 Input passed via the "hspSummaryId" GET parameter to /plugins/ajaxCalls/haltResumeHsp.php is not properly sanitised before being used in SQL "UPDATE" query. This vulnerability can be exploited by time-based blind SQL injection techniques to reveal sensitive information from the database.
The following PoC (Proof of Concept) will cause a delay of the script execution if MySQL server version is 5.*:
http://[host]/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus=1&empId=2&hsp SummaryId=%27%20OR%20%28select%20IF%28%28select%20mid%28version%28%29,1,1%29 %29=5,%28select%20BENCHMARK%281000000,ENCODE%28%22hello%22,%22goodbye%22%29% 29%29,%272%27%29%29%20--%202
Successful exploitation of this vulnerability requires attacker to be registered and logged-in.

2) Multiple Cross-Site Scripting (XSS) in OrangeHRM: CVE-2012-1507
2.1 Input passed via the "newHspStatus" GET parameter to /plugins/ajaxCalls/haltResumeHsp.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
The following PoC (Proof of Concept) demonstrate the vulnerability:
http://[host]/plugins/ajaxCalls/haltResumeHsp.php?hspSummaryId=1&newHspStatu s=1%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E&empId=1
2.2 Input passed via the "sortOrder" GET parameter to /templates/hrfunct/emppop.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
The following PoC (Proof of Concept) demonstrate the vulnerability:
http://[host]/templates/hrfunct/emppop.php?reqcode=1&sortOrder1=%22%3E%3Cscr ipt%3Ealert%28document.cookie%29;%3C/script%3E
2.3 Input passed via the "uri" GET parameter to /index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a administrator's browser session in context of affected website.
The following PoC (Proof of Concept) demonstrate the vulnerability:
http://[host]/index.php?uri=%22%3E%3C/iframe%3E%3Cscript%3Ealert%28document. cookie%29;%3C/script%3E


ImmuniWeb® On-Demand Web Application Penetration Test


Solution:
Upgrade to OrangeHRM 2.7 Stable Release.

More Information:
http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/


References:
[1] High-Tech Bridge Advisory HTB23080 - https://www.immuniweb.com/advisory/HTB23080 - Multiple vulnerabilities in OrangeHRM.
[2] OrangeHRM - http://www.orangehrm.com - OrangeHRM is the world’s most popular Open Source Human Resource Management Software (HRMS) with over 1,000,000 users globally.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
User Comments
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Quick Start
Technology
Products
Free Trial