header-logo
Suggest Exploit
vendor:
OrangeHRM
by:
SecurityFocus
7,5
CVSS
HIGH
SQL-injection and Cross-site Scripting
89, 79
CWE
Product Name: OrangeHRM
Affected Version From: 2.7 RC
Affected Version To: 2.7 RC
Patch Exists: Yes
Related CWE: N/A
CPE: OrangeHRM
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2012

OrangeHRM Multiple Vulnerabilities

OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Mitigation:

Apply the latest security patches and updates to the application and underlying database.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/53433/info
   
OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php?uri=%22%3E%3C/iframe%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

Navigation

Suggest Exploit

Services By CQR