HTML Injection Vulnerability in Jorani Leave Management System by Jorani
CVE-2023-45540

6.5MEDIUM

Key Information:

Vendor

Jorani

Status
Leave Management System
Vendor
CVE Published:
16 October 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-45540?

The Jorani Leave Management System version 1.0.3 is susceptible to an HTML injection vulnerability that permits remote attackers to execute arbitrary HTML code. This exploit is facilitated through the comment field on the List of Leave requests page, potentially allowing malicious actors to manipulate the user interface or perform phishing attacks. Users of this version are advised to implement security measures and consider updating to prevent exploitation of this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-45540
Created by soundarkutty

References

https://github.com/soundarkutty/HTML-Injection/blob/main/...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

JSON
.