charlesbickel/cve-2021-38619Proof-of-concept for CVE-2021-38619: unauthenticated stored XSS in openBaraza HCM HR Payroll v3.1.6, with payload examples for credential theft and session hijacking.
openBaraza HCM v.3.1.6 does not properly neutralize user-controllable input, this could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user from multiple pages. If an attacker injects arbitray javascript payload into vulnerable pages and valid users attempt to visit affected pages the payload will be executed. This could result in stealing credentials, session hijacking, or delivering malware to the victim.
Discoverer credits: Charles Bickel & Gideon Gray
Vulnerable page: http://serverip:9090/hr/application.jsp
Vulnerable textboxes: first_name, surname, email
Payloads:
Affected page: http://serverip:9090/hr/index.jsp?view=23:0
Vulnerable page:
Vulnerable textboxes: business_name, primary_contact, primary_email, confirm_email
Payloads:
Affected page: http://serverip:9090/hr/index.jsp?view=94:0
