Bugtraq mailing list archives
RE: TimeTrex Time and Attendance Cookie Theft
From: "Alex Eden" <Alex.Eden () senet-int com>
Date: Thu, 21 Aug 2008 17:09:59 -0400
So, what are the feasible attack vectors?... With the login fields that you show there none... It is, however, a good indication that the rest of the code may be vulnerable, but to stage an XSS attack you need to have user access to a deployed system. -----Original Message----- From: DoZ () HackersCenter com [mailto:DoZ () HackersCenter com] Sent: Thursday, August 21, 2008 12:50 PM To: bugtraq () securityfocus com Subject: TimeTrex Time and Attendance Cookie Theft [HSC] TimeTrex Time and Attendance Cookie Theft TimeTrex allows companies to track and monitor employee attendance accurately in real-time from anywhere in the world. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Attacker can tricks the user's computer into running code which is treated as trustworthy because it appears to belong to the server, allowing the attacker to obtain a copy of the cookie or perform other operations. Hackers Center Security Group (http://www.hackerscenter.com) Credit: Doz Class: Cross Site Scripting Remote: Yes Product: TimeTrex Vendor: http://www.timetrex.com Version: N/A Attackers can exploit these issues via a web client. http://site.com/interface/Login.php?user_name=admin&password=XSS http://site.com/interface/Login.php?user_name=XSS Google Dork: TimeTrex Time and Attendance - Secure Login Reference: http://www.hackerscenter.com/index.php?/HSC-Research-Group/Advisories/HSC-Tim eTrex-Time-and-Attendance-Cookie-Theft.html
Current thread:
- TimeTrex Time and Attendance Cookie Theft DoZ (Aug 21)
- RE: TimeTrex Time and Attendance Cookie Theft Alex Eden (Aug 22)
- Re: TimeTrex Time and Attendance Cookie Theft Mike (Aug 23)
- <Possible follow-ups>
- Re: RE: TimeTrex Time and Attendance Cookie Theft hi (Aug 22)