Description

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-09-21T09:17:06.387Z",
  "pubdate": "2026-09-21T09:17:06.387Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the SVG File Upload component of Omega Solution HRM OS, specifically affecting files accessible via the /media/view/ path.\nThis vulnerability allows remote attackers to inject malicious scripts into the application, which are then executed in the context of a victim's browser session.\nThe flaw affects all versions of Omega Solution HRM OS up to 20260717.\nSuccessful exploitation could lead to unauthorized access to sensitive user data, session hijacking, or the execution of unauthorized actions on behalf of the user.\nThe vulnerability is currently subject to public disclosure, and the vendor has remained unresponsive to notifications, increasing the risk of active exploitation in the wild.",
  "technicalDetails": "The vulnerability resides in the SVG File Upload component of Omega Solution HRM OS, which fails to adequately sanitize or validate user-supplied SVG files before they are processed and stored.\nSpecifically, the /media/view/ function fails to enforce necessary security controls when rendering or serving SVG files. Because SVG files are XML-based, they can inherently contain embedded scripts within <script> tags or through event handlers like 'onload' within vector elements.\nThe root cause is an improper neutralization of input during web page generation (CWE-79). The application serves these uploaded files directly or without adequate Content Security Policy (CSP) headers that would otherwise restrict the execution of inline scripts.\nAn attacker can exploit this by uploading a specially crafted SVG file containing malicious JavaScript. Once the file is successfully uploaded, the attacker forces a victim to navigate to the /media/view/ URL corresponding to the malicious file. When the browser renders the SVG, the embedded script executes within the context of the user's session.\nThe attack is remote and does not require prior authentication if the endpoint is publicly accessible. The impact of this XSS includes the potential for session token theft via cookie access (unless mitigated by HttpOnly flags), redirection to malicious sites, or unauthorized execution of administrative actions through DOM manipulation.\nPost-exploitation, the attacker can leverage the victim's authenticated session to perform lateral movement or escalate privileges if the victim holds administrative rights within the HRM OS. Given the lack of input sanitization at the server level, the application treats the malicious SVG as trusted content, facilitating the injection of arbitrary malicious payloads.\nNo patches have been released or acknowledged by the vendor, leaving all versions up to 20260717 exposed to potential exploitation."
}