Description (CNA)
TimeClock Software 1.01 contains an authenticated time-based SQL injection vulnerability that allows attackers to enumerate valid usernames by manipulating the 'notes' parameter. Attackers can inject conditional time delays in the add_entry.php endpoint to determine user existence by measuring response time differences.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TimeClock Software / TimeClock Software | affected 1.01 |
CWE
CWE-89
References
- https://www.exploit-db.com/exploits/48874
- https://web.archive.org/web/20190104104315/http://timeclock-software.net/
- https://www.vulncheck.com/advisories/timeclock-software-authenticated-time-based-sql-injection
ADP enrichment
No English description supplied.
No references supplied.