CVE-2021-43851: high-severity vulnerability in anuko timetracker
SQL injection vulnerability in anuko timetracker
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 1.2%
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is posted along when navigating between organizational subgroups (groups.php file). Status parameter is used in multiple files to change a status of an entity such as making a project, task, or user inactive. This issue has been patched in version 1.19.33.5607. An upgrade is highly recommended. If an upgrade is not practical, introduce ttValidStatus function as in the latest version and start using it user input check blocks wherever status field is used. For groups.php fix, introduce ttValidInteger function as in the latest version and use it in the access check block in the file.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
anuko · timetrackerRelated CVEs — anuko timetracker
In the same product, most dangerous first.
CVE-2022-24707HIGHSQL injection in anuko timetrackerEPSS 7.2%CVE-2020-15255HIGHCSV injection in Anuko Time TrackerEPSS 3.5%CVE-2021-21352MEDIUMPredictable tokens used for password resetsEPSS 1.5%CVE-2021-41139HIGHReflected XSS vulnerability in time.phpEPSS 1.0%CVE-2023-32306HIGHTime Tracker has Blind SQL Injection Vulnerability in ReportsEPSS 0.7%CVE-2023-32308HIGHSQL Injection Vulnerability in anuko timetrackerEPSS 0.7%