HRM - Workable Zone : Ultimate HR System

vendor:

HRM - Workable Zone

by:

8bitsec

6,4

CVSS

MEDIUM

Directory Traversal / Stored XSS

79 (Cross-site Scripting)

CWE

Product Name: HRM - Workable Zone

Affected Version From: 1.2

Affected Version To: 1.2

Patch Exists: YES

Related CWE: N/A

CPE: a:workablezone:hrm_-_workable_zone_:1.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Kali Linux 2.0, Mac OS 10.12.6

2017

HRM – Workable Zone : Ultimate HR System <= 1.2 - Unauthenticated Directory Traversal / Stored XSS

Multiple Stored XSS vulnerabilities were found in Workable Zone, a Human resourse(HR) management software for companies of all sizes. The Stored XSS can be exploited by entering malicious payloads into the Last Name, First Name, and Contact Number fields when logged in as an Employee. The Directory Traversal vulnerability can be exploited by sending a request to the download page with a malicious filename parameter.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in the application.

Source

Exploit-DB raw data:

# Exploit Title: HRM - Workable Zone : Ultimate HR System <= 1.2 - Unauthenticated Directory Traversal / Stored XSS
# Date: 2017-09-05
# Exploit Author: 8bitsec
# Vendor Homepage: http://workablezone.com
# Software Link: https://codecanyon.net/item/hrm-workable-zone-ultimate-hr-system/20182372
# Version: 1.2
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-05

Product & Service Introduction:
===============================
Workable Zone is probably one of most customizable Human resourse(HR) management software for companies of all sizes.

Technical Details & Description:
================================

Multiple Stored XSS vulnerabilities found.

Directory Traversal vulnerability can disclose sensitive files.

Proof of Concept (PoC):
=======================

Stored XSS:

Logged as Employee:

Write your payload on:
Profile > Last Name

Other vulnerable fields include: First Name, Contact Number

Unauthenticated Directory Traversal:

http://localhost.com/download?type=document&filename=../../../../../etc/passwd

Credits & Authors:
==================
8bitsec - [https://twitter.com/_8bitsec]