OrangeHRM Sendmail Parameter Injection Vulnerability Leading to Arbitrary File Write and Code Execution

A critical vulnerability in OrangeHRM versions 5.0 through 5.7 allows for arbitrary file writing and execution of attacker-controlled content. This issue arises from an input-neutralization flaw in the mail configuration and delivery workflow, where user-controlled values are directly injected into the system's sendmail command without proper sanitization. As a result, certain sendmail behaviors can be exploited during email processing to write files on the server. In cases where these files are placed in web-accessible locations, the vulnerability can be leveraged for code execution. The flaw has been patched in version 5.8.

Impact

Exploitation of this vulnerability allows for arbitrary file writing on the server, with potential execution of attacker-controlled content, especially if the written files are accessible via the web.

Remediation

Users can upgrade to OrangeHRM version 5.8 to address this vulnerability.