CVE-2025-59920

Vulnerability

Analysis

CVE-2025-59920 is a high-severity blind authenticated SQL injection vulnerability found in time@work version 7.0.5, a project hour allocation system from systems@work [1]. The flaw resides in the IDClient parameter, which is processed when a user enters hours and the application queries the database to display assigned projects. If an attacker copies the query URL and opens it in a new browser window, the IDClient parameter becomes injectable [1].

Exploitation

Scenario

The vulnerability requires authentication to the application, but does not require the attacker to be a system administrator by admin—any authenticated user can exploit the blind SQL injection to query data from the database [1]. However, the impact varies significantly by privilege level. If the attacker uses the TWAdmin user with the sysadmin role enabled, successful exploitation escalates from database access to full operating system command execution [1].

Impact and

Mitigation

The CVSS v4.0 base score is 8.6 (High), with a vector indicating low attack complexity, no special attack requirements, low privileges, and no user interaction needed, with high impacts to both confidentiality and integrity [1]. The vendor has released a fix in version 8.0.4; users of version 7.0.5 are advised to upgrade immediately [1]. No public exploit is known at the time of publication [1].