bugtraq - TimeTrex Time and Attendance Cookie Theft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080821165007.25452.qmail@securityfocus.com>
Date: 21 Aug 2008 16:50:07 -0000
From: DoZ@...kersCenter.com
To: bugtraq@...urityfocus.com
Subject: TimeTrex Time and Attendance Cookie Theft

[HSC] TimeTrex Time and Attendance Cookie Theft


TimeTrex allows companies to track and monitor employee attendance accurately in real-time from anywhere

in the world. An attacker may leverage these issues to execute arbitrary script code in the browser of

an unsuspecting user in the context of the affected site. Attacker can tricks the user's computer into

running code which is treated as trustworthy because it appears to belong to the server, allowing the

attacker to obtain a copy of the cookie or perform other operations.



Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Doz

Class: Cross Site Scripting
Remote: Yes

Product: TimeTrex
Vendor: http://www.timetrex.com
Version: N/A


Attackers can exploit these issues via a web client.


http://site.com/interface/Login.php?user_name=admin&password=XSS
http://site.com/interface/Login.php?user_name=XSS




Google Dork: TimeTrex Time and Attendance - Secure Login

Reference: 

http://www.hackerscenter.com/index.php?/HSC-Research-Group/Advisories/HSC-TimeTrex-Time-and-Attendance-Cookie-Theft.html