Vulnerability · Published May 15, 2023 · Assigned by GitHub_M

CVE-2023-32308SQL Injection Vulnerability in anuko timetracker

High 8.2

In plain English

A high-severity SQL injection in timetracker from anuko. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.7%top 48.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php.

Affected products (as reported)

Vendor	Product	Versions
anuko	timetracker	< 1.22.11.5781

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

https://github.com/anuko/timetracker/security/advisories/GHSA-9g2c-7c7g-p58r x_refsource_CONFIRM
https://github.com/anuko/timetracker/commit/8a7367d7f77ea697c090f5ca4e19669181cc7bcf x_refsource_MISC