I. Overview 
OrangeHRM (Opensource 3.2.1, Professional & Enterprise 4.11) are prone to a 
multiple Blind SQL injection & XSS vulnerabilities. These vulnerabilities 
allows an attacker to inject SQL commands to compromise the affected database 
management system in HRM, perform operations on behalf of affected victim, 
redirect them to malicious sites, steal their credentials, and more. 

II. Severity 
Rating: High 
Remote: Yes 
Authentication Require: Yes 

III. Vendor's Description of Application 

OrangeHRM Solutions

Effective HR tools and options to suit your needs Start-up, SME, global 
enterprises, whichever one you may be, OrangeHRM offers you flexibility and 
freedom to select from free and paid versions of OrangeHRM backed with 
specialized expertise. Our HR modules cover many major human capital management 
extents. OrangeHRM is used by millions of users around the world in all 
industries. Explore our solutions and contact our consultants to assist you 
with your selection process.


IV. Vulnerability Details & Exploit 
1) Blind SQL Injection 

Request Method = GET


Request Method = POST

b) /symfony/web/index.php/recruitment/viewCandidates


2) Multiple Reflected XSS 

Request Method = GET 

a) /symfony/web/index.php/admin/saveJobTitle?jobTitleId=1';+confirm(0);+// 

Request Method = POST

b) /symfony/web/index.php/performance/saveReview                          
          saveReview360Form[reviewId] = [XSS Payload]          
          saveReview = [XSS Payload]                         

VI. Affected Systems 
Software: OrangeHRM 
Version:  OrangeHRM Opensource 3.2.1 or prior
   OrangeHRM Professional & Enterprise 4.11 or prior
Solution (Fix): No

VII. Vendor Response/Solution 
Vendor Contacted : 02/12/2015 
Vendor Response : 02/12/2015 
Shared Technical Details/Poc : 02/13/2015
Again Vendor Contacted : 03/04/2015
Vendor Response: No Response
Advisory Release : 04/10/2015

Discovered by Rehan Ahmed 

Sent through the Full Disclosure mailing list
Web Archives & RSS: http://seclists.org/fulldisclosure/

Reply via email to