Horilla HRMS Cross-Site Scripting Vulnerability in Profile Photo Upload

A cross-site scripting (XSS) vulnerability exists in Horilla, an open-source Human Resource Management System, in versions prior to 1.5.0. The issue arises during the profile photo update process, where the application fails to validate the file extension and content type. This oversight allows for the injection of malicious scripts. Version 1.5.0 addresses this vulnerability.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser. This could lead to cookie theft or other malicious actions.

Reproduction

To reproduce this vulnerability, upload a file with an HTML extension as a profile photo. Include a script tag in the file that, for example, alerts the document domain. The application will not properly sanitize the input, allowing the script to execute.

Remediation

Users can upgrade to Horilla version 1.5.0, which includes a patch for this vulnerability.