----------------------------------------------------------------------


Looking for a job?


Secunia is hiring skilled researchers and talented developers.


http://secunia.com/company/jobs/


----------------------------------------------------------------------

TITLE:
OrangeHRM Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA39795

VERIFY ADVISORY:
http://secunia.com/advisories/39795/

DESCRIPTION:
Some vulnerabilities have been discovered in OrangeHRM, which can be
exploited by malicious users to conduct script insertion and SQL
injection attacks and by malicious people to conduct cross-site
scripting, cross-site request forgery, and script insertion attacks.

1) Input passed to the ESS (Employee Self-Service) e.g. via the
"txtEmpLastName", "txtEmpFirstName", "txtEmpMiddleName", and
"txtEmpNickName" parameters to lib/controllers/CentralController.php
(when "reqcode" is set to "ESS", "capturemode" is set to
"updatemode", and "id" is set) is not properly sanitised before being
displayed to the user. This can be exploited to insert arbitrary HTML
and script code, which will be executed in a user's browser session
in context of an affected site when the malicious data is viewed.

2) Input passed e.g. via the "txtFirstName" and "txtLastName"
parameters to jobs.php (when "recruitcode" is set to
"ApplicantApply") is not properly sanitised in
lib/controllers/PublicController.php before being used. This can be
exploited to insert arbitrary HTML and script code, which will be
executed in a user's browser session in context of an affected site
when the malicious data is being viewed.

3) Input passed e.g. via the "year" parameter to
lib/controllers/CentralController.php (when "benifitcode" is set to
"Benefits" and "action" is set to "List_Benifits_Schedule") is not
properly sanitised before being used in SQL queries. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.

4) The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the
requests. This can be exploited to e.g. change email notification
configurations by tricking an administrative user into visiting a
malicious web site.

Successful exploitation of this vulnerability requires that
"magic_quotes_gpc" is disabled.

5) Input passed e.g. via the "loc_name" parameter to
lib/controllers/CentralController.php (when "reqcode" is set to "EMP"
and "VIEW" is set to "MAIN") is not properly sanitised before being
displayed to the user. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in context of an
affected site.

The vulnerabilities are confirmed in version 2.5.0.4. Other versions
may also be affected.

NOTE: Other scripts and parameters may also be affected. A security
issue related to authorization bypass in the Timesheet, Attendance,
HSP, Recruitment, and Leave modules was also reported.

SOLUTION:
Filter malicious characters and character sequences in a proxy. Do
not browse untrusted websites or follow untrusted links while logged
in to the application.

PROVIDED AND/OR DISCOVERED BY:
1 -4) Tamás Czigány and Laszlo Klock, SecurityAngel
5) An anonymous person

Additional information provided by Secunia Research.

ORIGINAL ADVISORY:
Tamás Czigány and Laszlo Klock, SecurityAngel:
http://archives.neohapsis.com/archives/bugtraq/2010-05/0056.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------