OrangeHRM Cross Site Scripting / SQL Injection

I. Overview ======================================================== OrangeHRM Opensource 3.2.1, Professional & Enterprise 4.11 are prone to a multiple Blind SQL injection & XSS vulnerabilities. These vulnerabilities allows an attacker to inject SQL commands to compromise the affected database...

CVE-2014-100021

Cross-site scripting XSS vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearchemployeenameempId parameter...

CVE-2014-100021

CVE-2014-100021 is an XSS vulnerability in OrangeHRM (Symfony-based path: symfony/web/index.php/pim/viewEmployeeList) that allows injection of arbitrary script/HTML through empsearch[employee_name][empId]. Affected product and version: OrangeHRM before 3.1.2. Root cause: improper handling of inpu...

CVE-2014-100021

Cross-site scripting XSS vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearchemployeenameempId parameter...

CVE-2012-1507

Multiple cross-site scripting XSS vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the 1 newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, 2 sortOrder1 parameter to templates/hrfunct/emppop.php, or 3 uri parameter to index.php...

CVE-2012-1506

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from...

Sql injection

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the 1 newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, 2 sortOrder1 parameter to templates/hrfunct/emppop.php, or 3 uri parameter to index.php...

CVE-2012-1507

CVE-2012-1507 is a set of Cross-Site Scripting (XSS) vulnerabilities in OrangeHRM prior to 2.7, exploitable via user-supplied input in three vectors: newHspStatus (plugins/ajaxCalls/haltResumeHsp.php), sortOrder1 (templates/hrfunct/emppop.php), and uri (index.php). The issue stems from insufficie...

CVE-2012-1506

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from...

CVE-2012-1506

OrangeHRM prior to 2.7 is affected by CVE-2012-1506: a SQL injection in the updateStatus function (lib/models/benefits/Hsp.php) triggered by the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. The vulnerability allows remote authenticated users to craft input that alters the SQL qu...

CVE-2012-1507

Multiple cross-site scripting XSS vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the 1 newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, 2 sortOrder1 parameter to templates/hrfunct/emppop.php, or 3 uri parameter to index.php...

OrangeHRM 2.6.3 (PluginController.php) Local File Inclusion Vulnerability

No description provided by source. ------------------------------------------------------------------------ Software................OrangeHRM 2.6.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.orangehrm.com/ Discovery...

OrangeHRM 2.6.0.1 - Local File Inclusion Vulnerability

No description provided by source. Exploit Title: OrangeHRM 2.6.0.1 Local File Inclusion Vulnerability Date: 11-10-2010 Author: ZonTa - LkHackerZ - Mail: zontahackersatgmaildotcom Software Link: http://www.orangehrm.com/product-download.php?type=stable-zip...

OrangeHRM 3.1.1 Cross Site Scripting

============================================================== Title ...| XSS vulnerability in OrangeHRM Version .| OrangeHRM 3.1.1 Date ....| 28.02.2014 Found ...| HauntIT Blog Home ....| http://www.orangehrm.com ============================================================== + from admin user:...

CVE-2011-5259

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2011-5258

Multiple cross-site scripting XSS vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the 1 uniqcode or 2 isAdmin parameter to index.php; or the 3 PATHINFO to lib/controllers/centralcontroller.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the 1 uniqcode or 2 isAdmin parameter to index.php; or the 3 PATHINFO to lib/controllers/centralcontroller.php...

Sql injection

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2011-5259

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter...