SQL Injection Vulnerability in anuko timetracker

Vulnerability

A boolean-based blind SQL injection vulnerability exists in invoices.php of anuko timetracker versions prior to 1.22.11.5781. The issue arises because after validating POST parameters, there is no check for errors before adjusting the invoice sorting order. This allows an attacker to inject malicious SQL via the sort_order or sort_option parameters [1][2].

Exploitation

An attacker can send a crafted POST request to invoices.php with malicious SQL in the sorting parameters. The injection is boolean-based blind, meaning the attacker can infer information based on the response behavior (e.g., timing or content differences). No authentication is required if the invoices page is accessible [2].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries against the Time Tracker database. This can lead to disclosure of sensitive data, such as user credentials or time tracking records. The impact is high, as it compromises confidentiality and may enable further attacks [2].

Mitigation

The vulnerability is fixed in version 1.22.11.5781 [1][2]. Users are advised to upgrade. If immediate upgrade is not possible, a workaround is to insert an additional check for errors (line 79) before calling ttGroupHelper::getActiveInvoices() in invoices.php [1][2].