Attack Chain

1. An unauthenticated attacker identifies the login form at login.php.
2. The attacker crafts a malicious POST request targeting the login_userid parameter.
3. The POST request contains a SQL payload designed to exploit the blind SQL injection vulnerability, using SLEEP functions (time-based) or RLIKE conditional statements (boolean-based).
4. The server processes the SQL payload within the login_userid parameter.
5. Based on the response time (time-based) or the boolean result (boolean-based), the attacker infers information about the database structure and contents.
6. The attacker iteratively refines the SQL payloads to extract more data.
7. Sensitive information, such as employee usernames and passwords, is extracted from the database.

Impact

Successful exploitation of this SQL injection vulnerability allows attackers to extract sensitive database information, including employee credentials and personal data. This can lead to unauthorized access to the system, data breaches, and potential compromise of employee accounts. The vulnerability affects PHP Timeclock 1.04, potentially impacting any organization using this software to manage employee time tracking. The CVSS v3.1 base score is 8.2, indicating a high severity.

Recommendation

• Apply available patches or upgrade to a secure version of PHP Timeclock to remediate CVE-2021-47966.
• Deploy the Sigma rule to detect SQL injection attempts against the login_userid parameter in login.php.
• Monitor web server logs for suspicious POST requests containing SQL syntax, specifically SLEEP and RLIKE functions.
• Implement input validation and sanitization on the login_userid parameter to prevent SQL injection attacks.