VulnerabilityModified

CVE-2023-32306

A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792.

CRITICAL 9.8EPSS 0.72%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.72% probability · 52th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: anuko/time tracker
Source: security-advisories@github.com

References

https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3Vendor Advisory
https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.