PT-2019-14003 · Humanica · Humanica Humatrix 7
Published
2019-08-18
·
Updated
2021-07-21
·
CVE-2019-15130
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Humanica Humatrix 7 versions 1.0.0.203 through 1.0.0.681
Description
The issue allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted "recruitment online/personalData/act personaltab.cfm" multiple-part POST request with a predictable
WRC01 USERID parameter. This enables the attacker to upload executable content, such as asp or aspx files, which can be used to execute OS commands on the server.Recommendations
For Humanica Humatrix 7 versions 1.0.0.203 through 1.0.0.681, consider restricting access to the "recruitment online/personalData/act personaltab.cfm" endpoint to prevent unauthenticated file uploads until a patch is available. Additionally, restrict the types of files that can be uploaded to the candidate's profile picture folder to minimize the risk of exploitation. As a temporary workaround, consider disabling the ability to upload files to the profile picture folder until the issue is resolved.
Exploit
Fix
Use of Insufficiently Random Values
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Humanica Humatrix 7