SQL injection in anuko timetracker

Vulnerability

Anuko Time Tracker versions prior to 1.20.0.5642 are vulnerable to UNION SQL injection and time-based blind SQL injection in the Puncher plugin [2]. The vulnerability exists because the Puncher plugin reuses code from other places and relies on an unsanitized date parameter in POST requests. This parameter is not validated before being used in database queries, allowing an attacker to inject malicious SQL [2]. The issue was fixed in version 1.20.0.5642 with a more robust fix in 1.20.0.5643 when the Puncher plugin was recoded [2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted POST request to the Puncher plugin with a malicious date parameter [1][2]. The attacker does not need any special network position beyond access to the Time Tracker application. No authentication is mentioned in the references, but the Puncher plugin likely requires user login. The attacker would send a POST request containing a date parameter with SQL injection payload, such as ' UNION SELECT ... or a time-based blind payload. The lack of input validation means the malicious SQL is passed directly to the database [1][2].

Impact

Successful exploitation allows an attacker to perform UNION SQL injection (retrieving arbitrary data from the database) or time-based blind SQL injection (extracting information by observing response delays) [2]. This could lead to disclosure of sensitive information stored in the Time Tracker database, such as user credentials, timetracking data, or other business data. The attacker gains read access to the database, potentially leading to further compromise [2].

Mitigation

The vulnerability is fixed in version 1.20.0.5642 and a more complete fix in 1.20.0.5643 [2]. Users should upgrade to version 1.20.0.5642 or later immediately. If upgrade is not practical, the vendor provides a workaround: add a validation check for the date parameter in the access checks portion of puncher.php, as implemented in the commit for version 1.20.0.5642 [1][2]. Note that this check is no longer needed if using the updated Puncher plugin from version 1.20.0.5643 [2].