Listen to this Post
This vulnerability exploits a logic flaw in the OrangeHRM password reset mechanism (versions 5.0 to 5.7). The reset process involves multiple steps: a user requests a reset for their account and receives a unique, time-limited token via email. This token is embedded in a link. Normally, submitting this link along with the username and a new password should finalize the reset only for that specific user.
The flaw exists in the final password submission endpoint. The application correctly validates the security token to ensure it is valid and unused. However, it does not verify that the `username` parameter submitted in this final POST request matches the identity of the account for which the reset token was originally generated. The system blindly accepts the supplied username, associates the new password with it, and completes the reset.
Therefore, an attacker who can obtain a valid reset token (e.g., by triggering a reset for an account they control or via email interception) can then modify the HTTP request. They keep the valid `token` parameter but change the `username` parameter to that of a target victim, such as an administrator. The application will then reset the password for the targeted user account, granting the attacker full control.
Platform: OrangeHRM
Version: 5.0 – 5.7
Vulnerability: Account Takeover
Severity: Critical
date: 2025-11-28
Prediction: 2025-12-10
What Undercode Say:
Check installed version grep -i version /var/www/html/orangehrm/symfony/lib/vendor/orangehrm/OHRM_VERSION Curl request for exploitation curl -X POST 'https://target/resetPassword' -d 'token=VALID_TOKEN&username=admin&newPassword=hacked!'
How Exploit:
- Attacker requests password reset for a low-privilege account they control.
- Attacker captures the reset token from the received email/link.
- Attacker crafts a POST request to the final reset endpoint, using the captured token but substituting the `username` parameter with
admin.
4. The application resets the administrator’s password.
5. Attacker logs in with the new credentials.
Protection from this CVE:
Apply patch
Upgrade to v5.8
Validate user-token binding
Impact:
Full account compromise
Privilege escalation
Complete system access
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
