What is CVE-2023-32306?

CVE-2023-32306 is a high-severity vulnerability in Anuko Time Tracker, classified under SQL Injection. CVSS score: 8.8/10. Published 2023-05-12.

How severe is CVE-2023-32306?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2023-32306 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Anuko Time Tracker

CVE-2023-32306

Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.

Vulnerability class: SQL Injection

EPSS: 0.007 (50.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Anuko Time_tracker
Anuko Timetracker — versions < 1.22.13.5792

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

indevi0us/indevi0us

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2023-32306?: CVE-2023-32306 is a high-severity vulnerability in Anuko Time Tracker, classified under SQL Injection. CVSS score: 8.8/10. Published 2023-05-12.
How severe is CVE-2023-32306?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2023-32306 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.