The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitment_online/personalData/act_acounttab.cfm txtNewUserName and hdNP fields.
References
Link | Resource |
---|---|
https://gist.github.com/suphapholt/5bac4f5cabadfc44746e2bc93c1be91d | Third Party Advisory |
https://www.humatrix7.com/sunfish5/ehrm/humanica/recruitment_online/personalData/qry_account.cfm | Broken Link |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-09-10T15:30:01
Updated: 2019-09-10T15:30:01
Reserved: 2019-09-08T00:00:00
Link: CVE-2019-16106
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-09-10T16:15:12.570
Modified: 2019-09-11T12:54:20.333
Link: CVE-2019-16106
JSON object: View
Redhat Information
No data.
CWE