Attack Chain

1. Attacker authenticates to the target Anuko Time Tracker instance using valid user credentials.
2. Attacker interacts with the /puncher.php interface to initiate a time entry session.
3. Attacker identifies the project ID associated with the current user session.
4. Attacker sends a malicious POST request to /puncher.php, injecting a SQL payload into the 'date' parameter designed to query the 'tt_users' table.
5. The application executes the injected SQL, causing the database to write the contents of the 'tt_users' table into the 'note' field of the current time entry.
6. Attacker navigates to /time_edit.php to view the created entry and exfiltrate the stolen credentials from the note field.

Impact

Successful exploitation allows for the exfiltration of usernames and password hashes from the 'tt_users' table, leading to potential privilege escalation or full compromise of the application.

Recommendation

• Upgrade Anuko Time Tracker to version 1.20.0.5642 or later to patch the vulnerable parameter handling in puncher.php.
• Audit existing time entries for suspicious content in the 'note' field, particularly those containing database syntax or account credentials.
• Implement restrictive access controls for the 'puncher' plugin if it is not required for all users.