CVE-2023-32306 — Time Tracker has Blind SQL Injection Vulnerability in Reports

Description (CNA)

Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.

Affected (CNA)

Vendor / product	Versions
anuko / timetracker	affected < 1.22.13.5792

CWE

CWE-89

References

https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3

ADP enrichment

CVE

No English description supplied.

https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3

CISA-ADP

No English description supplied.

No references supplied.