Module library
All modules
Visit vidocsecurity.com
Ethical Hacking Automation
Automate Recon and scanning process with Vidoc. All security teams in one place
Start for free
PHP Timeclock <=1.04 - Cross-Site Scripting
By kannthu
High
Vidoc Module
#xss
#php
#timeclock
#edb
Description
Author: pikpikcu
Classification
CWE-ID: CWE-79 CVSS-Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS-Score: 7.2 PHP Timeclock 1.04 and prior contains multiple cross-site scripting vulnerabilities via login.php, timeclock.php, reports/audit.php. and reports/timerpt.php
Reference
- https://www.exploit-db.com/exploits/49853
Metadata
max-request: 1
Module preview
Concurrent Requests (1)
1. HTTP Request template
GET
/login.php/'%3E%3Csv...
Matching conditions
status: 200
and
word: <svg/onload=alert`{{randstr}}`>, PHP Tim...
and
word: text/html
Passive global matcher
No matching conditions.
On match action
Report vulnerability