Evolution Consulting HRmaster Module HTML Injection Vulnerability in Registration Interface

A HTML injection vulnerability has been identified in the registration interface of Evolution Consulting Kft. HRmaster module version 235. This vulnerability allows an attacker to inject HTML tags into the firstname field, which are then sent out via email. This could lead to phishing scenarios targeting any previously unregistered email address. The injected HTML could be exploited in emails sent as confirmation after registration and after applying for a job.

Impact

Exploitation of this vulnerability could result in HTML injection, allowing for the creation of malicious emails that could be used for phishing attacks.