Listen to this Post
The vulnerability exists within the recruitment module’s file retrieval endpoint. When an authenticated user sends an HTTP request to download a candidate’s attachment (e.g., a CV), the application performs session validation but skips a critical authorization check. The system fails to verify if the user’s role has permissions to access the Recruitment module. Specifically, users with only ESS (Employee Self Service) access, who are explicitly restricted from recruitment data, can construct a direct request to the endpoint. By knowing or guessing the correct URL pattern and file ID, they can bypass the intended access controls. The server, upon confirming a valid session, proceeds to fetch and serve the sensitive file from the storage system without any further validation. This flaw allows any authenticated account to systematically download all candidate application documents, leading to a direct confidentiality breach.
Platform: OrangeHRM
Version: 5.0 – 5.7
Vulnerability: Unauthorized File Access
Severity: Medium
Date: 11/28/2025
Prediction: Patch released 5.8
What Undercode Say:
curl -v -H "Cookie: PHPSESSID=compromised_session" http://orangehrm-host/recruitment/attachment/download?fileId=123
Python request example
import requests
s = requests.Session()
s.cookies.set('PHPSESSID', 'stolen_cookie')
response = s.get('http://target/path/to/attachment')
How Exploit:
1. Attacker gains valid session/login.
2. Enumerates candidate attachment IDs.
3. Crafts direct download requests.
4. Exfiltrates sensitive applicant files.
Protection from this CVE:
Upgrade to v5.8.
Implement proper authorization middleware.
Audit endpoint access controls.
Impact:
Sensitive Data Exposure.
GDPR/Compliance Violations.
Reputational Damage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
