Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

OrangeHRM < 2.4.2 Multiple Vulnerabilities



The remote host is vulnerable to multiple attack vectors


The remote host is running OrangeHRM, a human resource management system written in PHP.

The version of OrangeHRM installed on the remote host fails to sanitize input to the 'Time Mod', 'Benefits Mod', 'Leave Mod', 'PIM Mod', and 'Admin Mod' parameters. Given this, an authenticated user may be able to bypass security restrictions and gain access to confidential data. In addition, the version of OrangeHRM is vulnerable to multiple cross-site scripting (XSS) attacks. An attacker, exploiting these XSS flaws, would be able to execute script code within the browser of an unsuspecting OrangeHRM user.


Upgrade to version 2.4.2 or higher