HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)

The primary impact of CVE-2020-37145 is the potential for unauthorized administrative account creation. An attacker could craft a malicious HTML page containing hidden form fields that mimic the employee registration form. When a legitimate administrator visits this page while authenticated, their browser will automatically submit the crafted form, creating a new user account with administrative privileges under the attacker's control. This grants the attacker full access to the HRSALE system, enabling them to modify data, configure settings, and potentially compromise the entire application. The blast radius extends to the entire HRSALE deployment, as any administrator account can be exploited to create a backdoor.

Organizations utilizing HRSALE version 1.1.8 are at risk. This includes businesses relying on HRSALE for human resource management functions, particularly those with limited security expertise or those who have not implemented robust input validation and CSRF protection measures. Shared hosting environments where HRSALE is installed are also at increased risk due to the potential for cross-tenant vulnerabilities.

• php / web:

curl -I 'http://your-hrsale-site.com/employee_registration.php?username=attacker&password=attacker'

• generic web:

 grep -i 'attacker' /var/log/apache2/access.log

1. 2026-02-05Disclosure

   disclosure

1. Gereserveerd2026-02-03
2. Gepubliceerd2026-02-05
3. Gewijzigd2026-03-05
4. EPSS bijgewerkt2026-03-23

Since a fixed version of HRSALE is not available to address CVE-2020-37145, mitigation strategies must focus on preventative measures. Implementing strict input validation on the employee registration form is crucial, ensuring that all data received is properly sanitized and validated before being processed. Furthermore, implementing CSRF tokens on all sensitive forms, including the registration form, will significantly reduce the risk of exploitation. Consider using a Web Application Firewall (WAF) with CSRF protection rules to provide an additional layer of defense. Regularly review user accounts and permissions to identify any suspicious activity.