CVE-2022-24707

CVE-2022-24707 的 PoC Puncher 插件存在 SQL 注入漏洞。可以构造 POST 请求以利用 SQL 注入并泄漏数据库内容。已在 Anuko Time Tracker 1.20.0.5640 上测试。 root@kitploit: python3 exploit.py --help usage: exploit.py -h --username USERNAME --password PASSWORD --host HOST --sqli SQLI optional arguments: -h, --help show this help message and...

CVE-2022-24707_AnukoTimeTracker_Version-1.20.0_POC

CVE-2022-24707 Anuko Time Tracker SQLインジェクションエクスプロイト Anuko Time Trackerのバージョン1.20.0のpuncher機能におけるSQLインジェクションの脆弱性を示すセキュリティ評価ツールです。このツールは、以下の簡単な手順に従って使用すると、ttusersデータベース全体をダンプし、すべてのエントリを明らかにします。 ⚠️ 免責事項 このツールは以下の目的を意図しています: セキュリティ研究および教育 許可を得たペネトレーションテスト 管理された環境での脆弱性デモンストレーション...

EUVD-2020-19933

Malware in sbrugna...

EUVD-2020-7266

Malware in sbrugna...

EUVD-2021-16061

Malware in sbrugna...

EUVD-2022-29573

Malicious code in bioql PyPI...

EUVD-2021-28256

Malicious code in bioql PyPI...

EUVD-2021-8676

Malicious code in bioql PyPI...

EUVD-2022-29574

Malicious code in bioql PyPI...

EUVD-2021-30720

Malicious code in bioql PyPI...

CVE-2023-32308

anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for error...

CVE-2022-24708

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with element...

CVE-2021-43851

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is...

CVE-2021-29436

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery CSRF vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an...

CVE-2021-21352

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess...

CVE-2020-27422

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account...

CVE-2020-27423

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox...

CVE-2022-24707

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin...

CVE-2020-15255

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software for example, when a cell value starts with an equal sign. This is fixed in version 1.19.23.5325...

CVE-2023-32308

anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for error...