CVE-2022-24707

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker versions prior to 1.20.0.5642

Description The issue is related to the Time Tracker Puncher plugin, which reused code from other places and relied on an unsanitized date parameter in POST requests. This allowed for the crafting of malicious SQL requests for the Time Tracker database. The vulnerability can be exploited remotely, enabling an attacker to execute arbitrary SQL queries in the Time Tracker database.

Recommendations For versions prior to 1.20.0.5642, upgrade to version 1.20.0.5642 to resolve the issue. For users unable to upgrade, add their own checks to input to mitigate the risk. As a temporary workaround, consider adding validation to the date parameter in POST requests to prevent malicious SQL injection.