CVE-2023-32306 - CVE House
Back to Database
Status published High CVE-2023-32306

Time Tracker has Blind SQL Injection Vulnerability in Reports

Vulnerability Description

Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32306

Credits & Attribution

No credits recorded in the NVD database.

References

More from anuko

View All →
CVE-2023-32308
SQL Injection Vulnerability in anuko timetracker
High 8.2
CVE-2023-32066
Time Tracker has Stored XSS vulnerability in Week View plugin
Medium 5.4
CVE-2022-24708
Stored XSS vulnerability in anuko/timetracker
Medium 6.5
CVE-2022-24707
SQL injection in anuko timetracker
High 7.4
CVE-2021-43851
SQL injection vulnerability in anuko timetracker
High 8.1

Affected Vendor

Affected Software

timetracker
Vulnerable Versions:
< 1.22.13.5792

Timeline

Official Publish: May 12th, 2023
Last Modified: January 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact