Infor Global HR CVE-2024-51423 Reflected XSS Vulnerability Analysis

Key Information Vulnerability Type Reflected XSS (authenticated) CVE ID CVE-2024-51423 Affected Versions Infor Global HR v11.23.03.00.21 and earlier versions Vulnerability Description The vulnerability exists in the URL endpoint handling class lists, triggered via the parameter during error message rendering. When an undefined or invalid value is passed through the URL, the system attempts to load a non-existent class, generating an error message that includes the provided input without proper sanitization or encoding. Attackers can inject malicious HTML or JavaScript code into this parameter. When reflected in the error message, the payload executes in the user’s browser context, leading to a Cross-Site Scripting (XSS) vulnerability. Exploitation Method Modify the parameter in the URL to include a malicious payload, such as JavaScript or HTML code. Deliver the modified URL to victims via phishing, social engineering, or other attack vectors. When the victim navigates to the tampered URL, the application reflects the malicious input directly into the error message without sufficient sanitization. The victim’s browser renders the injected payload within the error message, enabling arbitrary script execution in the victim’s browser. Examples Example 1 - Simple JavaScript Alert Injection - Payload: - URL Encoded Payload: - PoC: Displays an alert box with "1" Example 2 - Remote JavaScript Injection for Data Theft - Payload: - URL Encoded Payload: - PoC: Loads a remote script and steals data

Goal Reached Thanks to every supporter — we hit 100%!

Infor Global HR CVE-2024-51423 Reflected XSS Vulnerability Analysis