https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 23 Jul 2026 22:56:39 +0000 https://vulnerability.circl.lu/sighting/a24f723b-ce68-4b72-a4d0-a5cf712b7e88/export {"uuid": "a24f723b-ce68-4b72-a4d0-a5cf712b7e88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-qv4m-m73m-8hj7", "type": "seen", "source": "https://gist.github.com/alon710/0f714f8f5aa1155832cd576f5999e54b", "content": "# GHSA-QV4M-M73M-8HJ7: GHSA-qv4m-m73m-8hj7: Authenticated Arbitrary File Upload leading to Remote Code Execution in NotrinosERP\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/GHSA-QV4M-M73M-8HJ7\n\n## Summary\nAn authenticated remote code execution vulnerability exists in NotrinosERP (versions up to and including 1.0.0) within the Human Resource Management (HRM) module. Users with employee management permissions can upload arbitrary file types, including PHP scripts, which are written directly to a web-accessible directory. This allows for arbitrary code execution in the context of the web-server user.\n\n## TL;DR\nAuthenticated users with SA_EMPLOYEE permissions in NotrinosERP versions up to and including 1.0.0 can upload arbitrary PHP scripts via the employee document upload interface, resulting in remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-434, CWE-79, CWE-22\n- **Attack Vector**: Network\n- **CVSS Severity**: 8.8 (High)\n- **EPSS Score**: N/A\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- NotrinosERP Human Resource Management (HRM) module\n- **NotrinosERP**: <= 1.0.0 (Fixed in: `None`)\n\n## Mitigation\n\n- Randomize upload filenames using server-generated UUIDs or unique hashes without executable extensions.\n- Implement a strict allow-list of safe, non-executable document extensions (e.g., PDF, DOCX, PNG, JPG).\n- Perform backend MIME-type validation of file contents using PHP's Fileinfo extension instead of relying on the user-supplied HTTP Content-Type header.\n- Disable execution of scripts within the /company/ directory tree via web server configurations (.htaccess or Nginx location rules).\n- Move the upload storage directory completely outside of the public web-server document root.\n\n**Remediation Steps:**\n1. Open the file 'hrm/manage/employees.php' and locate the 'tab_documents()' function.\n2. Replace the direct filesystem write logic that uses '$_FILES['doc_file']['name']' with a secure path generator using a unique UUID.\n3. Update 'hrm/includes/ui/employee_ui.inc' to sanitize and HTML-encode any stored filenames before outputting them to 'href' attributes to block stored XSS.\n4. Deploy an '.htaccess' file in '/company/0/documents/' containing 'php_admin_flag engine off' to block script execution in the upload tree.\n\n## References\n\n- [NotrinosERP Repository](https://github.com/notrinos/NotrinosERP)\n- [GitHub Security Advisory GHSA-qv4m-m73m-8hj7](https://github.com/notrinos/NotrinosERP/security/advisories/GHSA-qv4m-m73m-8hj7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-QV4M-M73M-8HJ7) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-11T02:11:58.952476Z"} {"uuid": "a24f723b-ce68-4b72-a4d0-a5cf712b7e88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-qv4m-m73m-8hj7", "type": "seen", "source": "https://gist.github.com/alon710/0f714f8f5aa1155832cd576f5999e54b", "content": "# GHSA-QV4M-M73M-8HJ7: GHSA-qv4m-m73m-8hj7: Authenticated Arbitrary File Upload leading to Remote Code Execution in NotrinosERP\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/GHSA-QV4M-M73M-8HJ7\n\n## Summary\nAn authenticated remote code execution vulnerability exists in NotrinosERP (versions up to and including 1.0.0) within the Human Resource Management (HRM) module. Users with employee management permissions can upload arbitrary file types, including PHP scripts, which are written directly to a web-accessible directory. This allows for arbitrary code execution in the context of the web-server user.\n\n## TL;DR\nAuthenticated users with SA_EMPLOYEE permissions in NotrinosERP versions up to and including 1.0.0 can upload arbitrary PHP scripts via the employee document upload interface, resulting in remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-434, CWE-79, CWE-22\n- **Attack Vector**: Network\n- **CVSS Severity**: 8.8 (High)\n- **EPSS Score**: N/A\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- NotrinosERP Human Resource Management (HRM) module\n- **NotrinosERP**: <= 1.0.0 (Fixed in: `None`)\n\n## Mitigation\n\n- Randomize upload filenames using server-generated UUIDs or unique hashes without executable extensions.\n- Implement a strict allow-list of safe, non-executable document extensions (e.g., PDF, DOCX, PNG, JPG).\n- Perform backend MIME-type validation of file contents using PHP's Fileinfo extension instead of relying on the user-supplied HTTP Content-Type header.\n- Disable execution of scripts within the /company/ directory tree via web server configurations (.htaccess or Nginx location rules).\n- Move the upload storage directory completely outside of the public web-server document root.\n\n**Remediation Steps:**\n1. Open the file 'hrm/manage/employees.php' and locate the 'tab_documents()' function.\n2. Replace the direct filesystem write logic that uses '$_FILES['doc_file']['name']' with a secure path generator using a unique UUID.\n3. Update 'hrm/includes/ui/employee_ui.inc' to sanitize and HTML-encode any stored filenames before outputting them to 'href' attributes to block stored XSS.\n4. Deploy an '.htaccess' file in '/company/0/documents/' containing 'php_admin_flag engine off' to block script execution in the upload tree.\n\n## References\n\n- [NotrinosERP Repository](https://github.com/notrinos/NotrinosERP)\n- [GitHub Security Advisory GHSA-qv4m-m73m-8hj7](https://github.com/notrinos/NotrinosERP/security/advisories/GHSA-qv4m-m73m-8hj7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-QV4M-M73M-8HJ7) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-11T02:11:58.952476Z"} https://vulnerability.circl.lu/sighting/a24f723b-ce68-4b72-a4d0-a5cf712b7e88/export Sat, 11 Jul 2026 02:11:58 +0000