CVE-2023-53957

CVE-2023-53957 is a SameSite cookie vulnerability in Kimai version 1.30.10, a PHP-based time-tracking application. The flaw allows attackers to steal user session cookies by exploiting improper cookie attributes, specifically through a crafted PHP script that captures and writes session cookie data to a file on the server. This issue is rated critical with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-1275.

Any unauthenticated attacker with network access can exploit this vulnerability remotely with low complexity and no privileges required. By tricking victims into executing the crafted PHP script—potentially via social engineering or cross-site scripting—the attacker can capture valid session cookies, enabling session hijacking and unauthorized access to the victim's account in Kimai.

Advisories and references recommend mitigation through patching. The Kimai GitHub release page for tag 1.30.10 likely details fixes for this issue, urging users to upgrade to a patched version. An exploit is publicly available on Exploit-DB (ID 51278), and VulnCheck's advisory highlights the SameSite cookie misconfiguration leading to session hijacking, emphasizing immediate updates to prevent exploitation.