OrangeHRM Password Reset Workflow Vulnerability Leading to Account Takeover

A vulnerability in OrangeHRM's password reset workflow, present in versions 5.0 through 5.7, allows for account takeover. The issue arises because the system does not verify that the username in the final reset request matches the account for which the reset was initiated. An attacker who obtains a valid reset link can manipulate the username parameter to target a different user. This unvalidated username acceptance enables the attacker to reset the password for any account, including those with privileged access.

Impact

Exploiting this vulnerability allows an attacker to take over any user account, including accounts with administrative privileges.

Remediation

Users can upgrade to OrangeHRM version 5.8 to address this vulnerability.