Vulnerability Description
Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Anuko | Time Tracker | < 1.22.13.5792 |
Related Weaknesses (CWE)
References
- https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3Vendor Advisory
- https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3Vendor Advisory
FAQ
What is CVE-2023-32306?
CVE-2023-32306 is a vulnerability with a CVSS score of 8.8 (HIGH). Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `repor...
How severe is CVE-2023-32306?
CVE-2023-32306 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-32306?
Check the references section above for vendor advisories and patch information. Affected products include: Anuko Time Tracker.