A critical file upload vulnerability in Horilla HRMS versions prior to 1.5.0 allows authenticated attackers to facilitate credential theft through social engineering.

This is an improper neutralization of special elements (CWE-74) vulnerability where an authenticated user can upload a malicious HTML file masquerading as an image. This file can be used to host a deceptive login page that captures user credentials when accessed by victims.

The exploitation of this vulnerability poses a significant risk of account takeover and widespread credential harvesting within the organization. With a CVSS score of 8.8, this flaw represents a high-severity threat that could lead to unauthorized access to sensitive human resources data and potentially facilitate lateral movement within the corporate network.

Immediate Action: Upgrade Horilla HRMS to version 1.5.0 or later to implement the necessary file validation controls.

Proactive Monitoring: Review web server access logs for requests directed at uploaded profile picture paths that return HTML content or suspicious external redirects.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block file uploads containing HTML or script tags, and enforce strict content-type validation for user-uploaded profile assets.

Public Exploit Available: Unknown

Given the potential for credential harvesting and the associated risk of account compromise, administrators must prioritize the update to version 1.5.0 immediately. Organizations should also conduct a review of existing user-uploaded content to ensure no malicious files have already been staged within the environment.