Executive brief
mJobTime is a time management and labor tracking software used by businesses to manage workforce productivity. A security flaw in this software allows an unauthenticated attacker to remotely access and manipulate the underlying database. This could lead to the theft of sensitive employee data, modification of records, or a complete takeover of the server hosting the application.
Technical details
A blind SQL injection vulnerability exists in mJobTime v15.7.2 within the /Default.aspx/update_profile_Server endpoint. The flaw is reachable via a crafted POST request and does not require authentication. Because the application does not return direct SQL errors, the vulnerability is blind, but it can be exploited to exfiltrate data or execute system-level commands. In tested environments, researchers were able to use this injection to enable 'xp_cmdshell' on the underlying SQL Server, leading to remote code execution (RCE). An emergency update was reportedly released by the vendor following discovery.
Affected products
- mJobTime mJobTime 15.7.2
Timeline
- 2025-02-20: other: First contact with vendor
- 2025-02-21: patched: Vendor deployed emergency update
- 2025-11-25: disclosed: Researcher advisory published
- 2025-12-01: advisory: CVE published