In this post, we will discuss a critical vulnerability (CVE-2024-36428) that affects OrangeHRM, an open-source human resource management (HRM) solution. This particular vulnerability allows SQL injection in the "admin/viewProjects sortOrder" function of OrangeHRM 3.3.3, which grants the attacker the ability to compromise the entire system by executing arbitrary SQL queries. We will go through the details, including the exploit and possible mitigation techniques, covering the following topics:

Proof of Concept Code Snippet

4. Previous Reports/References

Overview of the Vulnerability

OrangeHRM 3.3.3 suffers from a vulnerability where an attacker has the ability to inject SQL queries into the admin/viewProjects sortOrder function. An attacker with admin privileges can craft custom SQL queries, and inject them into the system, potentially resulting in arbitrary SQL query execution. This could have severe consequences, including unauthorized data manipulation and pivoting further into the system.

The Exploit

The vulnerability arises from the lack of proper input validation and sanitization of the "sortOrder" parameter in the "admin/viewProjects" function of OrangeHRM. Consequently, an attacker can inject malicious SQL payloads via this input field to perform actions like unauthorized data retrieval, modification, or deletion.

The attacker logs into the administrator account of OrangeHRM

- The attacker navigates to the "admin/viewProjects" function
- The attacker exploits the vulnerability by crafting a malicious SQL payload using the sortOrder parameter, which lacks proper validation and sanitization

Proof of Concept Code Snippet

The following proof-of-concept demonstrates how an attacker can exploit the sortOrder SQL injection vulnerability in OrangeHRM 3.3.3:

POST /symfony/web/index.php/admin/viewProjects HTTP/1.1
Host: target
User-Agent: Mozilla/5. (Windows NT 10.; Win64; x64)
Accept: text/html,application/xhtml+xml,application/xml;q=.9,image/webp,*/*;q=.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

jobTitle=&sortField=P.name&sortOrder=[SQLi]

Replace the [SQLi] portion with the desired SQL payload to execute arbitrary SQL queries. However, we strongly discourage the use of this code for malicious purposes; its purpose is for educational purposes and to raise awareness regarding this vulnerability.

CVE (Common Vulnerabilities and Exposures) database entry for CVE-2024-36428 can be found here

- CVE-2024-36428: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36428

Furthermore, OrangeHRM has been notified of this vulnerability, and users are encouraged to apply necessary patches and updates when available.

How to Mitigate the Threat

Organizations using OrangeHRM 3.3.3 should consider taking the following measures to protect themselves against this vulnerability:

Apply available patches and updates from the official OrangeHRM website or repository

- Validate and sanitize all user inputs, including the sortOrder parameter, to prevent SQL injection attacks

Conclusion

CVE-2024-36428 is a critical vulnerability that affects OrangeHRM 3.3.3 through SQL injection in the "admin/viewProjects sortOrder" function. It is crucial to understand the potential severity of this vulnerability and take immediate action in mitigating the associated risk. By implementing proper input validation and sanitation, along with staying up-to-date with the latest security patches and guidelines, organizations can minimize the risk of being compromised through SQL injection attacks.

Timeline

Published on: 05/27/2024 23:15:13 UTC
Last modified on: 08/20/2024 16:35:17 UTC