CVE-2022-24707

CVE-2022-24707 の PoC SQLインジェクションの脆弱性がPuncherプラグインに存在します。悪意のあるPOSTリクエストを送信することで、SQLインジェクションを悪用し、データベースの内容を漏洩させることが可能です。これはAnuko Time Tracker 1.20.0.5640でテストされています。 root@kitploit: python3 exploit.py --help usage: exploit.py -h --username USERNAME --password PASSWORD --host HOST --sqli SQLI optional...

CVE-2022-24707_AnukoTimeTracker_Version-1.20.0_POC

CVE-2022-24707 Anuko Time Tracker SQL 注入利用工具 一个安全评估工具，用于演示 Anuko Time Tracker 1.20.0 版本 puncher 功能中的 SQL 注入漏洞。该工具可以导出整个 ttusers 数据库，并揭示每一条记录，只需按照以下简单说明使用即可！ ⚠️ 免责声明 该工具仅用于： 安全研究与教育 经授权的渗透测试 在受控环境中进行漏洞演示 未经授权对你不拥有或未获得明确测试许可的系统进行使用是违法的。 🚀 功能特性 自动利用 ：从登录到凭据提取的简化流程 SQL 注入 ：利用 puncher 功能中的基于时间的 SQL 注入...

EUVD-2020-19933

Malware in sbrugna...

EUVD-2020-7266

Malware in sbrugna...

EUVD-2021-16061

Malware in sbrugna...

EUVD-2021-28256

Malicious code in bioql PyPI...

EUVD-2022-29573

Malicious code in bioql PyPI...

EUVD-2021-8676

Malicious code in bioql PyPI...

EUVD-2022-29574

Malicious code in bioql PyPI...

EUVD-2021-30720

Malicious code in bioql PyPI...

CVE-2023-32308

anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for error...

CVE-2022-24708

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with element...

CVE-2021-43851

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is...

CVE-2021-29436

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery CSRF vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an...

CVE-2021-21352

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess...

CVE-2020-27422

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account...

CVE-2020-27423

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox...

CVE-2022-24707

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin...

CVE-2020-15255

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software for example, when a cell value starts with an equal sign. This is fixed in version 1.19.23.5325...

CVE-2023-32308 SQL Injection Vulnerability in anuko timetracker

anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for error...