WorkDo HRM SaaS Insecure Permissions Vulnerability Allowing Unauthorized Leave Requests

A vulnerability exists in WorkDo HRM SaaS HR and Payroll Tool version 8.1, allowing authenticated users to create leave or resignation records for other users. This issue arises from inadequate authorization checks, enabling users to manipulate request parameters and submit unauthorized applications on behalf of others.

Impact

Exploitation of this vulnerability allows users to impersonate other employees by submitting fraudulent leave or resignation requests, potentially leading to payroll discrepancies and misuse of company resources.

Reproduction

To reproduce this vulnerability, an authenticated user can send a POST request to the 'Add Leave Application' endpoint. The request must include the 'employee_id' parameter, which can be altered to represent another user within the organization. There are no server-side checks to verify if the requesting user is authorized to act on behalf of the specified employee.