OrangeHRM < 2.4.2 Multiple Vulnerabilities
High Nessus Network Monitor Plugin ID 5005
SynopsisThe remote host is vulnerable to multiple attack vectors
DescriptionThe remote host is running OrangeHRM, a human resource management system written in PHP.
The version of OrangeHRM installed on the remote host fails to sanitize input to the 'Time Mod', 'Benefits Mod', 'Leave Mod', 'PIM Mod', and 'Admin Mod' parameters. Given this, an authenticated user may be able to bypass security restrictions and gain access to confidential data. In addition, the version of OrangeHRM is vulnerable to multiple cross-site scripting (XSS) attacks. An attacker, exploiting these XSS flaws, would be able to execute script code within the browser of an unsuspecting OrangeHRM user.
SolutionUpgrade to version 2.4.2 or higher