This host is installed with SimpleHRM and is prone to sql injection vulnerability.

Successful exploitation will allow attacker to manipulate SQL queries in the backend database allowing for the manipulation or disclosure of arbitrary data. Impact Level: Application

No solution or patch is available as of 20th February, 2015. Information regarding this issue will be updated once the solution details are available. For updates refer to http://www.simplehrm.com

Flaw is due to the /index.php/user/setLogin script not properly sanitizing user-supplied input to the 'username' parameter.

SimpleHRM version 2.3 and 2.2, Other versions may also be affected.

Send a crafted HTTP GET request and check whether it is able to execute sql query or not.

• http://www.exploit-db.com/exploits/24954
• http://www.openwall.com/lists/oss-security/2013/04/17/1

---

Updated on 2017-03-28