a+HRD and a+HCM Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in a+HRD versions through 7.5 and a+HCM version 8.1, developed by aEnrich. This vulnerability allows authenticated remote attackers to upload files containing malicious JavaScript. The injected script executes on the client side when a user is deceived into visiting a specific URL.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users are advised to upgrade to a+HRD version 6.8 or later and install the latest patches. For a+HCM, contact aEnrich customer service for assistance.