horilla 1.3.0 Query Parameter eval eval injection

Summaryinfo

A vulnerability labeled as problematic has been found in horilla 1.3.0. Affected is the function eval of the component Query Parameter Handler. Executing a manipulation can lead to eval injection. This vulnerability is registered as CVE-2025-48868. It is possible to launch the attack remotely. Furthermore, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in horilla 1.3.0. This vulnerability affects the function eval of the component Query Parameter Handler. The manipulation with an unknown input leads to a eval injection vulnerability. The CWE definition for the vulnerability is CWE-95. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval() function on a user-controlled query parameter in the project_bulk_archive view. This allows privileged users (e.g., administrators) to execute arbitrary system commands on the server. While having Django’s DEBUG=True makes exploitation visibly easier by returning command output in the HTTP response, this is not required. The vulnerability can still be exploited in DEBUG=False mode by using blind payloads such as a reverse shell, leading to full remote code execution. This issue has been patched in version 1.3.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-48868 since 05/27/2025. The exploitation appears to be easy. The attack can be initiated remotely. The exploitation requires an enhanced level of successful authentication. Technical details and also a public exploit are known.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 1.3.1 eliminates this vulnerability. Applying the patch b0aab62b3a5fe6b7114b5c58db129b3744b4d8cc is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Exploit-DB (52497). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• horilla

Version

• 1.3.0

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion