icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons_061

OrangeHRM < 2.4.2 Multiple Vulnerabilities

High

Synopsis

The remote host is vulnerable to multiple attack vectors

Description

The remote host is running OrangeHRM, a human resource management system written in PHP.

The version of OrangeHRM installed on the remote host fails to sanitize input to the 'Time Mod', 'Benefits Mod', 'Leave Mod', 'PIM Mod', and 'Admin Mod' parameters. Given this, an authenticated user may be able to bypass security restrictions and gain access to confidential data. In addition, the version of OrangeHRM is vulnerable to multiple cross-site scripting (XSS) attacks. An attacker, exploiting these XSS flaws, would be able to execute script code within the browser of an unsuspecting OrangeHRM user.

Solution

Upgrade to version 2.4.2 or higher