Time Tracker has Blind SQL Injection Vulnerability in Reports

Vulnerability

A time-based blind SQL injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. The reports.php page failed to validate all parameters in POST requests, allowing attackers to inject malicious SQL queries into the Time Tracker database. The issue affects all versions before 1.22.13.5792 [1].

Exploitation

An attacker can send a crafted POST request to the reports.php endpoint with manipulated parameters. No prior authentication is required, as the vulnerable endpoint is accessible to unauthenticated users. By observing time delays in the server's response, the attacker can infer the truth of injected SQL conditions, enabling a time-based blind extraction of data [1].

Impact

Successful exploitation allows an attacker to extract sensitive information from the Time Tracker database, such as user credentials or other confidential data. The attack does not enable direct modification of data or remote code execution, but the information disclosure can be a critical first step in further compromising the system [1].

Mitigation

Time Tracker version 1.22.13.5792 and later contain a fix for this vulnerability. As a workaround, if upgrading is not immediately possible, users can apply the fixed code from ttReportHelper.class.php as available in the patched version [1]. No evidence of this CVE being listed in CISA's Known Exploited Vulnerabilities (KEV) catalog exists at the time of writing.