Executive brief
MyT-PM is an open-source project and task management system used by organizations to track work, time, and resources. A security flaw in version 1.5.1 allows a logged-in user to run unauthorized database commands. This could lead to the theft of sensitive project data, exposure of user credentials, or unauthorized modification of business records.
Technical details
An SQL injection vulnerability exists in MyT-PM version 1.5.1 within the '/charge/admin' endpoint. The vulnerability is rooted in the improper neutralization of the 'Charge[group_total]' POST parameter. An authenticated attacker can exploit this by submitting crafted POST requests containing error-based, time-based blind, or stacked query payloads. Successful exploitation allows for the extraction of sensitive information from the underlying MySQL or SQLite database or the manipulation of existing data. The vulnerability was originally identified in 2019 and affects the Yii Framework-based implementation of the application's administrative charge grid.
Affected products
- MyT Project Management MyT-PM (Manage Your Team) Project Management 1.5.1
Timeline
- 2019-01-07: disclosed: Exploit code published on Exploit-DB
- 2026-04-12: advisory: CVE formally assigned and published by VulnCheck/NVD