CVE-2011-5258 Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.ph...
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.php; or the (3) PATH_INFO to lib/controllers/centralcontroller.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| orangehrm | <= 2.6.11 | No fix listed |
| orangehrm | = 2.6.0 | No fix listed |
| orangehrm | = 2.6.0.1 | No fix listed |
| orangehrm | = 2.6.1 | No fix listed |
| orangehrm | = 2.6.2 | No fix listed |
| orangehrm | = 2.6.3 | No fix listed |
| orangehrm | = 2.6.4 | No fix listed |
| orangehrm | = 2.6.5 | No fix listed |
| orangehrm | = 2.6.6 | No fix listed |
| orangehrm | = 2.6.7 | No fix listed |
| orangehrm | = 2.6.8 | No fix listed |
| orangehrm | = 2.6.8.1 | No fix listed |
| orangehrm | = 2.6.9 | No fix listed |
| orangehrm | = 2.6.10 | No fix listed |
References
- blog.orangehrm.com vendor-advisory
- 77416 exploit vdb-entry
- 77417 exploit vdb-entry
- 47014 third-party-advisory vendor-advisory
- 20111130 Multiple vulnerabilities in OrangeHRM mailing-list
- 50857 exploit vdb-entry
- orangehrm-multiple-xss(71568) vdb-entry
- www.htbridge.ch exploit