CVE-2023-32308: fallo de gravedad alta en anuko timetracker
SQL Injection Vulnerability in anuko timetracker
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.7%
anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Productos afectados
anuko · timetrackerCVEs relacionadas — anuko timetracker
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-24707HIGHSQL injection in anuko timetrackerEPSS 7.2%CVE-2020-15255HIGHCSV injection in Anuko Time TrackerEPSS 3.5%CVE-2021-21352MEDIUMPredictable tokens used for password resetsEPSS 1.5%CVE-2021-43851HIGHSQL injection vulnerability in anuko timetrackerEPSS 1.2%CVE-2021-41139HIGHReflected XSS vulnerability in time.phpEPSS 1.0%CVE-2023-32306HIGHTime Tracker has Blind SQL Injection Vulnerability in ReportsEPSS 0.7%