Executive brief
PHP Timeclock, a web-based employee time-tracking system, contains security flaws that allow attackers to run malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link or submitting a malicious form, an attacker could steal login session information or perform unauthorized actions on behalf of the user. This affects the login page and various reporting tools used by administrators and employees.
Technical details
PHP Timeclock 1.04 and earlier versions suffer from multiple reflected cross-site scripting (XSS) vulnerabilities. The first issue exists in the handling of URL paths for login.php, timeclock.php, audit.php, and timerpt.php, where arbitrary JavaScript can be executed by appending payloads to the GET request URL. The second issue involves improper sanitization of the 'from_date' and 'to_date' POST parameters in the reporting modules (audit.php, total_hours.php, and timerpt.php). An unauthenticated remote attacker can exploit these by inducing a user to visit a malicious URL or submit a crafted request, leading to script execution in the context of the victim's browser session. No official patch has been identified in the provided documentation.
Affected products
- PHP Timeclock PHP Timeclock 1.04 and prior
Timeline
- 2021-05-03: disclosed: Vulnerability discovered and exploit published by Tyler Butler
- 2026-05-15: advisory: CVE published to NVD dataset