SQL injection in anuko timetracker
41Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 7.4epss 7.2%
da publicação à arma69 dias
Publicada no NVD23 de fev.
1ª PoC+69d
probabilidade de exploração
7.2%top 6% das CVEs
exploração observada
nãonenhuma fonte reporta
4 exploit(s) público(s)
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Produtos afetados
anuko · timetrackerPoCs públicas encontradas — 4
exploitdbwww.exploit-db.com/exploits/50915não verificadogithubgithub.com/Altelus1/CVE-2022-24707★ 13githubgithub.com/thepiyushkumarshukla/CVE-2022-24707_AnukoTimeTracker_Version-1.20.0_POC★ 0cve_referencepacketstormsecurity.com/files/167060/Anuko-Time-Tracker-1.20.0.5640-SQL-Injection.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.