{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/anuko/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2022-24707"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Time Tracker (\u003c 1.20.0.5642)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","sqli","credential-theft"],"_cs_type":"advisory","_cs_vendors":["Anuko"],"content_html":"\u003cp\u003eCVE-2022-24707 is an authenticated SQL injection vulnerability affecting Anuko Time Tracker versions prior to 1.20.0.5642. The vulnerability resides in the puncher.php component, where the 'date' parameter in a POST request fails to properly sanitize input. An attacker with low-level privileges can inject arbitrary SQL commands to extract contents from the 'tt_users' table by leveraging the application's functionality to write entry notes.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the target Anuko Time Tracker instance using valid user credentials.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the /puncher.php interface to initiate a time entry session.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the project ID associated with the current user session.\u003c/li\u003e\n\u003cli\u003eAttacker sends a malicious POST request to /puncher.php, injecting a SQL payload into the 'date' parameter designed to query the 'tt_users' table.\u003c/li\u003e\n\u003cli\u003eThe application executes the injected SQL, causing the database to write the contents of the 'tt_users' table into the 'note' field of the current time entry.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to /time_edit.php to view the created entry and exfiltrate the stolen credentials from the note field.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the exfiltration of usernames and password hashes from the 'tt_users' table, leading to potential privilege escalation or full compromise of the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Anuko Time Tracker to version 1.20.0.5642 or later to patch the vulnerable parameter handling in puncher.php.\u003c/li\u003e\n\u003cli\u003eAudit existing time entries for suspicious content in the 'note' field, particularly those containing database syntax or account credentials.\u003c/li\u003e\n\u003cli\u003eImplement restrictive access controls for the 'puncher' plugin if it is not required for all users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T21:06:13Z","date_published":"2026-10-26T21:06:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-anuko-sqli/","summary":"An authenticated SQL injection vulnerability in the Anuko Time Tracker puncher component allows attackers to exfiltrate database credentials via the date parameter.","title":"Anuko Time Tracker: Authenticated SQL Injection via puncher.php (CVE-2022-24707)","url":"https://feed.craftedsignal.io/briefs/2026-10-anuko-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Anuko","version":"https://jsonfeed.org/version/1.1"}