← back
CVE-2021-47967

PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters

CVSS 5.1 MEDIUMEPSS 0.2%CWE-79
PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, or inject code through from_date and to_date parameters in report requests to execute scripts in user browsers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
Timeclock · PHP Timeclock
public PoCs found — 1
cve_referencewww.exploit-db.com/exploits/49853unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04/https://www.exploit-db.com/exploits/49853https://www.vulncheck.com/advisories/php-timeclock-multiple-cross-site-scripting-via-parametershttp://timeclock.sourceforge.net