PT-2021-23979 · Unknown · Anuko Time Tracker

Indevi0Us · Published 2021-12-21 · Updated 2021-12-28 · CVE-2021-43851

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Anuko Time Tracker versions 1.19.33.5606 and prior

Description: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. A SQL injection issue exists in multiple files due to improper checking of the group and status parameters in POST requests. The group parameter is used when navigating between organizational subgroups in the groups.php file. The status parameter is used in multiple files to change the status of an entity, such as making a project, task, or user inactive. This issue has been patched in version 1.19.33.5607.

Recommendations: For versions 1.19.33.5606 and prior, upgrade to version 1.19.33.5607 or later. If an upgrade is not practical, introduce the ttValidStatus function as in the latest version and use it in user input check blocks wherever the status field is used. For the groups.php fix, introduce the ttValidInteger function as in the latest version and use it in the access check block in the file.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-43851

GHSA-WX6X-6RQ3-PQCC

Affected Products

Anuko Time Tracker

References · 7

• https://github.com/anuko/timetracker/commit/0cf32f1046418aa2e5218b0b370064820c330c6a · Patch
• https://github.com/anuko/timetracker/commit/94fda0cc0c9c20ab98d38ccc75ff040d13dc7f1b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43851 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43851 · Vendor Advisory
• https://github.com/anuko/timetracker/security/advisories/GHSA-wx6x-6rq3-pqcc · Note
• https://t.me/cvenotify/24756 · Telegram Post
• https://t.me/cibsecurity/34483 · Telegram Post