SQL Injection and Command Injection Vulnerabilities in Times Software E-Payroll

CVE-2025-9977

What is CVE-2025-9977?

A vulnerability in Times Software E-Payroll arises from inadequate sanitization of POST parameters during user login processes. This flaw can enable unauthenticated attackers to execute Denial of Service (DoS) operations. Furthermore, SQL injection attacks may also be viable, although the creation of a functional exploit has been hindered by existing backend filtering systems. Attempts to leverage command injection could reveal detailed error messages, inadvertently exposing sensitive information about the application’s internal architecture. The patching status remains uncertain as the vendor has not responded to outreach efforts.

References