Unauthenticated SQL Execution in mJobTime Admin Panel
CVE-2026-9209

9.3CRITICAL

Key Information:

Vendor

Mjob

Status
Mjobtime
Vendor
CVE Published:
8 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-9209?

The mJobTime application, specifically build 15.7.3.32, features an unauthenticated SQL execution vulnerability found in the Login.aspx admin panel. This flaw allows attackers to exploit the runQueryButton postback and exportSqlQuery_Server PageMethod, executing arbitrary SQL commands against the underlying Sybase SQL Anywhere database without proper server-side authentication. By leveraging this vulnerability, attackers can invoke sensitive functions, such as xp_cmdshell and xp_read_file, leading to pre-authentication remote code execution with LocalSystem privileges through a single, crafted HTTP request.

Affected Version(s)

mJobTime 0 <= 15.7.3.32

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-9209 - Proof of Concept

References

https://www.sprocketsecurity.com/blog/cve-2026-9209-pre-a...
technical-descriptionexploit
https://mjobtime.com/
product
https://www.vulncheck.com/advisories/mjobtime-unauthentic...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nate Fair of Sprocket Security
.