SQL injection in anuko timetracker
CVE-2022-24707

7.4HIGH

Key Information:

Vendor

Anuko

Status
Timetracker
Vendor
CVE Published:
24 February 2022

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2022-24707?

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.

Affected Version(s)

timetracker < 1.20.0.5642

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-24707
Created by Altelus1

CVE-2022-24707
Created by c0gnit00

References

https://github.com/anuko/timetracker/security/advisories/...
x_refsource_CONFIRM
https://github.com/anuko/timetracker/commit/0e2d6563e2d96...
x_refsource_MISC
http://packetstormsecurity.com/files/167060/Anuko-Time-Tr...
x_refsource_MISC

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.