CVE-2023-32306
Last modified
CVE-2023-32306 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. EPSS estimates a 0.72% chance of exploitation in the next 30 days.
Description
Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Anuko | Time Tracker | < 1.22.13.5792 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-32306?
How severe is CVE-2023-32306?
How do I fix CVE-2023-32306?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-3230Missing Authorization in GitHub repository fossbilling/fossb…7.5
- CVE-2023-32300Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
- CVE-2023-32301Discourse is an open source discussion platform. Prior to ve…5.3
- CVE-2023-32302Rejected reason: Authoritative user requested CVE rejection …
- CVE-2023-32303Planet is software that provides satellite data. The secret …5.5
- CVE-2023-32305aiven-extras is a PostgreSQL extension. Versions prior to 1.…8.8
- CVE-2023-32307Sofia-SIP is an open-source SIP User-Agent library, complian…7.5
- CVE-2023-32308anuko timetracker is an open source time tracking system. Bo…9.8
- CVE-2023-32309PyMdown Extensions is a set of extensions for the `Python-Ma…7.5
- CVE-2023-3231A vulnerability has been found in UJCMS up to 6.0.2 and clas…6.5
- CVE-2023-32310DataEase is an open source data visualization and analysis t…8.1
- CVE-2023-32311CloudExplorer Lite is an open source cloud management platfo…4.3
Are you affected by CVE-2023-32306?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST