Published: 17/09/2014 Updated: 29/08/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 445

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM prior to 2.7 allow remote malicious users to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
orangehrm orangehrm 2.6.0
orangehrm orangehrm 2.6.0.1
orangehrm orangehrm
orangehrm orangehrm 2.6.2
orangehrm orangehrm 2.6.9
orangehrm orangehrm 2.6
orangehrm orangehrm 2.6.11.3
orangehrm orangehrm 2.6.12
orangehrm orangehrm 2.6.7
orangehrm orangehrm 2.6.8
orangehrm orangehrm 2.6.8.1
orangehrm orangehrm 2.6.11
orangehrm orangehrm 2.6.11.2
orangehrm orangehrm 2.6.5
orangehrm orangehrm 2.6.6
orangehrm orangehrm 2.6.1
orangehrm orangehrm 2.6.10
orangehrm orangehrm 2.6.3
orangehrm orangehrm 2.6.4

source: wwwsecurityfocuscom/bid/53433/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the und ...

source: wwwsecurityfocuscom/bid/53433/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the under ...

source: wwwsecurityfocuscom/bid/53433/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the u ...

CWE-79 http://osvdb.org/81745 http://osvdb.org/81746 http://secunia.com/advisories/49072 http://www.securityfocus.com/bid/53433 http://osvdb.org/81744 http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/https://www.htbridge.com/advisory/HTB23080 https://exchange.xforce.ibmcloud.com/vulnerabilities/75473 https://nvd.nist.gov https://www.exploit-db.com/exploits/37144/

CVE-2012-1507

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect