Onderwerp: TimeTrex Time and Attendance Cookie Theft

[HSC] TimeTrex Time and Attendance Cookie Theft


TimeTrex allows companies to track and monitor employee attendance accurately in real-time from anywhere

in the world. An attacker may leverage these issues to execute arbitrary script code in the browser of

an unsuspecting user in the context of the affected site. Attacker can tricks the user's computer into

running code which is treated as trustworthy because it appears to belong to the server, allowing the

attacker to obtain a copy of the cookie or perform other operations.



Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Doz

Class: Cross Site Scripting
Remote: Yes

Product: TimeTrex
Vendor: http://www.timetrex.com
Version: N/A


Attackers can exploit these issues via a web client.


http://site.com/interface/Login.php?...n&password=XSS
http://site.com/interface/Login.php?user_name=XSS




Google Dork: TimeTrex Time and Attendance - Secure Login

Reference:

http://www.hackerscenter.com/index.p...kie-Theft.html

So, what are the feasible attack vectors?...

With the login fields that you show there none...

It is, however, a good indication that the rest of the code may be
vulnerable, but to stage an XSS attack you need to have user access to a
deployed system.

-----Original Message-----
From: DoZ@HackersCenter.com [mailtooZ@HackersCenter.com]
Sent: Thursday, August 21, 2008 12:50 PM
To: bugtraq@securityfocus.com
Subject: TimeTrex Time and Attendance Cookie Theft

[HSC] TimeTrex Time and Attendance Cookie Theft


TimeTrex allows companies to track and monitor employee attendance accurately
in real-time from anywhere

in the world. An attacker may leverage these issues to execute arbitrary
script code in the browser of

an unsuspecting user in the context of the affected site. Attacker can tricks
the user's computer into

running code which is treated as trustworthy because it appears to belong to
the server, allowing the

attacker to obtain a copy of the cookie or perform other operations.



Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Doz

Class: Cross Site Scripting
Remote: Yes

Product: TimeTrex
Vendor: http://www.timetrex.com
Version: N/A


Attackers can exploit these issues via a web client.


http://site.com/interface/Login.php?...n&password=XSS
http://site.com/interface/Login.php?user_name=XSS




Google Dork: TimeTrex Time and Attendance - Secure Login

Reference:

http://www.hackerscenter.com/index.p...sories/HSC-Tim
eTrex-Time-and-Attendance-Cookie-Theft.html

This issue only affects TimeTrex v2.2.12 and older.

TimeTrex v2.2.13 and newer are patched, the latest version can be
downloaded from:

http://www.timetrex.com/

or

http://sourceforge.net/project/showf...kage_id=200595

Thanks.


On 21 Aug 2008 16:50:07 -0000
DoZ@HackersCenter.com wrote:

> [HSC] TimeTrex Time and Attendance Cookie Theft
>
>
> TimeTrex allows companies to track and monitor employee attendance
> accurately in real-time from anywhere
>
> in the world. An attacker may leverage these issues to execute
> arbitrary script code in the browser of
>
> an unsuspecting user in the context of the affected site. Attacker
> can tricks the user's computer into
>
> running code which is treated as trustworthy because it appears to
> belong to the server, allowing the
>
> attacker to obtain a copy of the cookie or perform other operations.
>
>
>
> Hackers Center Security Group (http://www.hackerscenter.com)
> Credit: Doz
>
> Class: Cross Site Scripting
> Remote: Yes
>
> Product: TimeTrex
> Vendor: http://www.timetrex.com
> Version: N/A
>
>
> Attackers can exploit these issues via a web client.
>
>
> http://site.com/interface/Login.php?...n&password=XSS
> http://site.com/interface/Login.php?user_name=XSS
>
>
>
>
> Google Dork: TimeTrex Time and Attendance - Secure Login
>
> Reference:
>
> http://www.hackerscenter.com/index.p...kie-Theft.html


--
Mike (ipso@snappymail.ca)