PT-2023-23717 · Unknown · Anuko Time Tracker

Indevi0Us · Published 2023-05-15 · Updated 2023-05-25 · CVE-2023-32308

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions anuko timetracker versions prior to 1.22.11.5781

Description The issue is related to a Boolean-based blind SQL injection vulnerability in the invoices.php file of anuko timetracker, an open source time tracking system. This vulnerability existed due to a coding error after validating parameters in POST requests, where there was no check for errors before adjusting the invoice sorting order. As a result, it was possible to craft a POST request with malicious SQL for the Time Tracker database.

Recommendations For versions prior to 1.22.11.5781, upgrade to version 1.22.11.5781 or later to resolve the issue. As a temporary workaround for users unable to upgrade, consider inserting an additional check for errors in a condition before calling ttGroupHelper::getActiveInvoices() in invoices.php.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-32308

GHSA-9G2C-7C7G-P58R

Affected Products

Anuko Time Tracker

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32308.json · Exploit
• https://github.com/anuko/timetracker/commit/8a7367d7f77ea697c090f5ca4e19669181cc7bcf · Patch
• https://github.com/anuko/timetracker/security/advisories/GHSA-9g2c-7c7g-p58r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32308 · Security Note
• https://t.me/cibsecurity/64171 · Telegram Post