PT-2022-27440 · Unknown · Human Resource Management System

Rajeshwar Singh · Published 2022-11-25 · Updated 2023-12-26 · CVE-2022-45218

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Human Resource Management System version 1.0.0

Description The Human Resource Management System contains a cross-site scripting (XSS) vulnerability. This issue is triggered via a crafted payload injected into an authentication error message.

Recommendations For Human Resource Management System version 1.0.0, consider disabling authentication error messages until a patch is available to prevent potential exploitation of the XSS vulnerability. Restrict access to authentication endpoints to minimize the risk of exploitation. Avoid using crafted payloads in authentication processes until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-45218

Affected Products

Human Resource Management System

References · 6

• 🔥 https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45218 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-45218 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45218 · Vendor Advisory
• https://t.me/cibsecurity/53517 · Telegram Post
• https://sourcecodester.com/sites/default/files/download/oretnom23/hrm.zip · Note
• https://t.me/cvenotify/38486 · Telegram Post