Detections
Analytics

OrangeHRM < 2.4.2 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 5005

Synopsis

The remote host is vulnerable to multiple attack vectors

Description

The remote host is running OrangeHRM, a human resource management system written in PHP.

The version of OrangeHRM installed on the remote host fails to sanitize input to the 'Time Mod', 'Benefits Mod', 'Leave Mod', 'PIM Mod', and 'Admin Mod' parameters. Given this, an authenticated user may be able to bypass security restrictions and gain access to confidential data. In addition, the version of OrangeHRM is vulnerable to multiple cross-site scripting (XSS) attacks. An attacker, exploiting these XSS flaws, would be able to execute script code within the browser of an unsuspecting OrangeHRM user.

Solution

Upgrade to version 2.4.2 or higher

See Also

http://sourceforge.net/project/shownotes.php?release_id=678118

Plugin Details

Severity: High

ID: 5005

Family: Web Servers

Published: 8/18/2004

Updated: 3/6/2019

Reference Information

BID: 34715