IceHRM Reflected Cross-Site Scripting Vulnerability in Login Page

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the login page of IceHRM version 32.4.0.OS. This vulnerability arises from inadequate sanitization of the 'next' parameter, which is returned in the application's response without proper escaping. As a result, an attacker can exploit this issue by persuading a user to click on a specially crafted URL, leading to the execution of arbitrary JavaScript code in the context of the user's browser. This vulnerability exists despite the application having some sanitization measures in place.

Impact

Exploitation of this vulnerability allows for reflected Cross-Site Scripting, where an attacker can execute malicious scripts in the context of the victim's user session.

Reproduction

To reproduce this vulnerability, send a request to the IceHRM login page with a crafted 'next' parameter that includes JavaScript code. The application will reflect this code back in the response, executing it in the user's browser.