CVE-2023-32306

HIGH

8.8

Description

Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published5/12/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

anuko:time_tracker

Weaknesses (CWE)

CWE-89

References

https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3(security-advisories@github.com)

https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.