SQL Injection Vulnerability in anuko timetracker
CVE-2023-32308

8.2HIGH

Key Information:

Vendor

Anuko

Status
Timetracker
Vendor
CVE Published:
15 May 2023

What is CVE-2023-32308?

Anuko Timetracker, an open-source time tracking system, contains a boolean-based blind SQL injection vulnerability in the invoices.php file, found in versions prior to 1.22.11.5781. This vulnerability is due to a coding oversight in the validation of parameters for POST requests, which omitted an error check prior to modifying the invoice sorting order. As a consequence, an attacker could exploit this weakness by crafting a malicious SQL query through a specially formed POST request, potentially impacting the integrity of the Time Tracker database. To mitigate this issue, it is critical for users to upgrade to the latest version. For those unable to perform an upgrade, implementing an additional error check before invoking the ttGroupHelper::getActiveInvoices() function in invoices.php is advisable.

Affected Version(s)

timetracker < 1.22.11.5781

References

https://github.com/anuko/timetracker/security/advisories/...
x_refsource_CONFIRM
https://github.com/anuko/timetracker/commit/8a7367d7f77ea...
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.