CVE-2022-24707

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.

• CWE-89
• CWE-89

• http://packetstormsecurity.com/files/167060/Anuko-Time-Tracker-1.20.0.5640-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/anuko/timetracker/commit/0e2d6563e2d969209c502a1eae4ddd8e87b73299Patch, Third Party Advisory
• https://github.com/anuko/timetracker/security/advisories/GHSA-wqx7-95fx-wjxjThird Party Advisory
• http://packetstormsecurity.com/files/167060/Anuko-Time-Tracker-1.20.0.5640-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/anuko/timetracker/commit/0e2d6563e2d969209c502a1eae4ddd8e87b73299Patch, Third Party Advisory
• https://github.com/anuko/timetracker/security/advisories/GHSA-wqx7-95fx-wjxjThird Party Advisory

Published

Feb 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24700An issue was discovered in WinAPRS 2.9.0. A buffer overflow …7.5
• CVE-2022-24701An issue was discovered in WinAPRS 2.9.0. A buffer overflow …7.8
• CVE-2022-24702An issue was discovered in WinAPRS 2.9.0. A buffer overflow …9.8
• CVE-2022-24704The rad_packet_recv function in opt/src/accel-pppd/radius/pa…9.8
• CVE-2022-24705The rad_packet_recv function in radius/packet.c suffers from…9.8
• CVE-2022-24706In Apache CouchDB prior to 3.2.2, an attacker can access an …9.8
• CVE-2022-24708Anuko Time Tracker is an open source, web-based time trackin…5.4
• CVE-2022-24709@awsui/components-react is the main AWS UI package which con…6.1
• CVE-2022-2471Stack-based Buffer Overflow vulnerability in the EZVIZ Motio…9.8
• CVE-2022-24710Weblate is a copyleft software web-based continuous localiza…5.4
• CVE-2022-24711CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…9.8
• CVE-2022-24712CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…8.8