← Advisories

IceHrm <=7.1 Multiple Vulnerabilities

Critical
Advisory ID
ZSL-2014-5215
Release Date
08 December 2014
Vendor
IceHrm - http://www.icehrm.com
Affected Version
<= 7.1
CVE
N/A
Tested On
Apache/2.2.15 (Unix), PHP/5.3.3, MySQL 5.1.73
Summary

IceHrm is Human Resource Management web software for small and medium sized organizations. The software is written in PHP. It has community (free), commercial and hosted (cloud) solution.

Description

IceHrm <= 7.1 suffers from multiple vulnerabilities including Local File Inclusion, Cross-Site Scripting, Malicious File Upload, Cross-Site Request Forgery and Code Execution.

Proof of Concept
icehrm_multi.txtTXT
Disclosure Timeline
01.12.2014Vulnerabilities discovered.
02.12.2014Vendor contacted.
02.12.2014Vendor confirms the issues promising patch.
04.12.2014Vendor releases update (new version - v.7.2).
05.12.2014Vendor confirms the patch release.
08.12.2014Coordinated public security advisory released.
Credits
Vulnerability discovered by Stefan Petrushevski
References
[2]http://cxsecurity.com/issue/WLB-2014120041
[3]http://packetstormsecurity.com/files/129416
[4]http://www.securityfocus.com/bid/71552
[5]http://1337day.com/exploit/22972
[6]https://www.yascanner.com/#!/x/20866
[7]http://osvdb.org/show/osvdb/115531
[8]http://osvdb.org/show/osvdb/115532
[9]http://osvdb.org/show/osvdb/115533
[10]http://osvdb.org/show/osvdb/115534
[11]http://osvdb.org/show/osvdb/115535
[12]http://osvdb.org/show/osvdb/115536
[13]http://osvdb.org/show/osvdb/115537
[14]http://www.exploit-db.com/exploits/35490/
[15]http://xforce.iss.net/xforce/xfdb/99242
Changelog
08.12.2014Initial release
09.12.2014Added reference [3], [4], [5], [6], [7], [8], [9], [10], [11], [12] and [13]
10.12.2014Added reference [14]
15.12.2014Added reference [15]