Horilla HRMS version 1.3.0 contains a critical remote code execution vulnerability that allows an authenticated administrator to execute arbitrary system commands on the host server.

This flaw stems from improper neutralization of directives in dynamically evaluated code (CWE-95), specifically within the project_bulk_archive view. An authenticated user with administrative privileges can inject malicious payloads into a query parameter to achieve remote code execution.

Successful exploitation of this vulnerability grants an attacker full control over the underlying server hosting the Horilla HRMS application. Given the CVSS score of 7.2, this represents a high severity risk that could lead to complete data exfiltration, system compromise, and significant operational disruption. Unauthorized access to HR systems often involves sensitive employee data, which increases the potential for severe regulatory and reputational consequences.

Immediate Action: Update Horilla HRMS to version 1.3.1 or later to implement the fix for the eval injection vulnerability.

Proactive Monitoring: Review application logs for suspicious activity involving the project_bulk_archive view, particularly unusual query parameters or unexpected system process spawning.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing suspicious code patterns or eval-related syntax in HTTP parameters.

Public Exploit Available: Yes, an ExploitDB entry exists for this vulnerability.

This vulnerability poses a significant risk to organizational infrastructure due to the potential for full server compromise. Administrators must prioritize upgrading to version 1.3.1 immediately to eliminate the vulnerable code path. If an immediate update is not feasible, restrict administrative access to the application and monitor server logs for any signs of unauthorized command execution.