PHP Timeclock <=1.04 - Cross-Site Scripting

By kannthu

High

Vidoc Module

#xss#php#timeclock#edb

Description

Author: pikpikcu Classification CWE-ID: CWE-79 CVSS-Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS-Score: 7.2 PHP Timeclock 1.04 and prior contains multiple cross-site scripting vulnerabilities via login.php, timeclock.php, reports/audit.php. and reports/timerpt.php Reference - https://www.exploit-db.com/exploits/49853 Metadata max-request: 1

Module preview

Concurrent Requests (1)

1. HTTP Request template

GET/login.php/'%3E%3Csv...

Matching conditions

status: 200and

word: <svg/onload=alert`{{randstr}}`>, PHP Tim...and

word: text/html

Passive global matcher

No matching conditions.

On match action

Report vulnerability