CVE-2019-1010287

MEDIUMNuclei

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-1010287 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Timesheet Next Gen

Browse Timesheet Next Gen / Timesheet Next Gen
CVE List1.5.3 and earlieraffected

Nuclei templates

1
ProjectDiscoveryMEDIUMTimesheet Next Gen <=1.5.3 - Cross-Site ScriptingCVSS 6.1

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

Upgrade to a patched version of Timesheet Next Gen (1.5.4 or above) that properly sanitizes user input to prevent XSS attacks.

WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2019timesheetxsstimesheet_next_gen_projectvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:timesheet_next_gen_project:timesheet_next_gen:*:*:*:*:*:*:*:*
Google: inurl:"/timesheet/login.php"
http://www.mdh-tz.info/ https://sourceforge.net/p/tsheetx/discussion/779083/thread/7fcb52f696/ https://sourceforge.net/p/tsheetx/code/497/tree/branches/legacy/login.php#l40 https://nvd.nist.gov/vuln/detail/CVE-2019-1010287 https://github.com/merlinepedra25/nuclei-templates

Source: ProjectDiscovery

References

3