Time Tracker has Blind SQL Injection Vulnerability in Reports
CVE-2023-32306

8.8HIGH

Key Information:

Vendor

Anuko

Status
Timetracker
Vendor
CVE Published:
12 May 2023

What is CVE-2023-32306?

A time-based blind injection vulnerability has been identified in the reports functionality of the Time Tracker system, affecting versions before 1.22.13.5792. The underlying issue arises from insufficient validation of parameters in POST requests on the reports.php page. This flaw enables attackers to send specially crafted POST requests that may execute malicious SQL commands against the Time Tracker database. Users are advised to update to version 1.22.13.5792 or later for resolution, and as a temporary measure, can utilize the fixed code from ttReportHelper.class.php available in version 1.22.13.5792.

Affected Version(s)

timetracker < 1.22.13.5792

References

https://github.com/anuko/timetracker/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.