Pbrong Hrms Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Pbrong Hrms version 1.0.1. The issue arises in the UpdateRecruitmentById function within the file handler/recruitment.go. This vulnerability allows for the injection of unfiltered user input, which the system processes as JavaScript, leading to cross-site scripting. The vulnerability can be exploited remotely and is now public knowledge.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, access the recruitment management function and use the UpdateRecruitmentById method. During this process, input data can be submitted without any cross-site scripting filters. Once the data is saved, the injected script will execute when the recruitment information is accessed.