Anuko Time Tracker: Authenticated SQL Injection via puncher.php (CVE-2022-24707)

CVE-2022-24707 is an authenticated SQL injection vulnerability affecting Anuko Time Tracker versions prior to 1.20.0.5642. The vulnerability resides in the puncher.php component, where the 'date' parameter in a POST request fails to properly sanitize input. An attacker with low-level privileges can inject arbitrary SQL commands to extract contents from the 'tt_users' table by leveraging the application's functionality to write entry notes.

Attack Chain

1. Attacker authenticates to the target Anuko Time Tracker instance using valid user credentials.
2. Attacker interacts with the /puncher.php interface to initiate a time entry session.
3. Attacker identifies the project ID associated with the current user session.
4. Attacker sends a malicious POST request to /puncher.php, injecting a SQL payload into the 'date' parameter designed to query the 'tt_users' table.
5. The application executes the injected SQL, causing the database to write the contents of the 'tt_users' table into the 'note' field of the current time entry.
6. Attacker navigates to /time_edit.php to view the created entry and exfiltrate the stolen credentials from the note field.

Impact

Successful exploitation allows for the exfiltration of usernames and password hashes from the 'tt_users' table, leading to potential privilege escalation or full compromise of the application.

Recommendation

• Upgrade Anuko Time Tracker to version 1.20.0.5642 or later to patch the vulnerable parameter handling in puncher.php.
• Audit existing time entries for suspicious content in the 'note' field, particularly those containing database syntax or account credentials.
• Implement restrictive access controls for the 'puncher' plugin if it is not required for all users.