CVE-2012-1507
OrangeHRM < 2.7 - Cross-Site Scripting via newHspStatus, sortOrder1, or uri Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-1507. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary The provided text describes an XSS vulnerability in OrangeHRM 2.7 RC, including a proof-of-concept URL that triggers a JavaScript alert with document.cookie. No executable exploit code is present.
Description
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index.php.
Exploits (3)
The provided text describes an XSS vulnerability in OrangeHRM 2.7 RC, including a proof-of-concept URL that triggers a JavaScript alert with document.cookie. No executable exploit code is present.
The provided text describes an XSS vulnerability in OrangeHRM 2.7 RC, with a proof-of-concept URL demonstrating a reflected XSS attack via the `sortOrder1` parameter. No executable exploit code is present, only a description and example URL.
This exploit demonstrates an XSS vulnerability in OrangeHRM 2.7 RC via a crafted URL that injects JavaScript into the `newHspStatus` parameter. The payload steals cookie-based authentication credentials by triggering an alert with `document.cookie`.