Simple HRM System 2.3 - Multiple Vulnerabilities

# Exploit Title: Multiple Vulnerabilities in Simple HRM system v2.3 and

below

# Date: 12/04/2013

# Exploit Author: Doraemon

# Vendor Homepage: http://www.simplehrm.com/

# Software Link: http://sourceforge.net/projects/simplehrm/

# Version: 2.2/2.3

# Tested on: 2.2 & 2.3

# CVE : CVE-2013-2498, CVE-2013-2499



Date Discovered: 07 March 2013



Vendor notified: 12 march 2013 (No response from vendor after 1 month)



Advisory posted: 12 April 2013



*

*



*CVE-2013-2498*



Simple HRM system is vulnerable to sqli attacks in their login page



An attacker can perform blind sql injection through the login form and

obtain information such as password hash.



*Attack URL:* http://localhost/simplehrm/index.php/user/setLogin

*Method:* POST

*Vuln Parameter: *username=*(SQL INJECTION)*&password=abcdef

*Vuln Type*: unsanitised input argument *($name)* in

*Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php

*Line:* 84

$res_company = getsingleindexrow('CALL

get_search_sql("'.TABLE_PREFIX.'company","email_id = \''.$name.'\' AND

isactive = 1 LIMIT 1")');



*CVE-2013-2499*



We discovered that if an attacker were to grab hold of the user's password

hash, the attacker can easily spoof a cookie and impersonate as anyone to

access the system. Together with the blind sql injection stated above, an

attacker can simply blind the password hash, userid, username and recreate

a cookie.



*Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php

*Line:* 215 $v_user_password =

md5($info['id_user'].$info['username'].$info['password']);



This vuln effectively defeats one of the primary purposes of password hashing.





Regards



Doraemon