During a PT activity, we managed to find two stored XSS vulnerabilities in some versions of TimeKeeper.
By analyzing the target, we tried some naïve XSS payloads in different input fields, such as:
<script>alert("XSS")</script>
Doing so, we detected two injection points.
Below, the two vulnerable items with the triggered alert("XSS") pop-ups:
The FSMLabs has fixed the vulnerability in TimeKeeper version 8.0.28.
As a result of testing, versions 8.0.17 through 8.0.27 are vulnerable to stored XSS.
Riccardo Degli Esposti
Francesco Iaria
Claudio Rimensi
Francesco Varotto