CVE-2023-32308
📋 TL;DR
Anuko Time Tracker versions before 1.22.11.5781 contain a blind SQL injection vulnerability in invoices.php that allows attackers to execute arbitrary SQL queries via crafted POST requests. This can lead to database manipulation, data theft, or system compromise. All users running vulnerable versions are affected.
💻 Affected Systems
- Anuko Time Tracker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, privilege escalation, and potential remote code execution through database functions.
Likely Case
Data theft of sensitive information (user credentials, financial data, time tracking records) and potential database corruption.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploitation requires sending crafted POST requests to invoices.php. The advisory provides technical details but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.22.11.5781
Vendor Advisory: https://github.com/anuko/timetracker/security/advisories/GHSA-9g2c-7c7g-p58r
Restart Required: No
Instructions:
1. Backup your database and application files. 2. Download version 1.22.11.5781 or later from the official repository. 3. Replace the existing installation with the updated version. 4. Verify the invoices.php file contains the fix from commit 8a7367d7f77ea697c090f5ca4e19669181cc7bcf.
🔧 Temporary Workarounds
Manual code patch
allAdd error checking before calling ttGroupHelper::getActiveInvoices() in invoices.php as suggested in the advisory
Edit invoices.php and add proper error validation before the vulnerable function call
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with SQL injection rules
- Restrict network access to the Time Tracker application to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check if your version is below 1.22.11.5781 by examining the version file or checking the application interfaceCheck Version:
Check the VERSION file in the installation directory or view the application's about pageVerify Fix Applied:
Verify that invoices.php contains the fix from commit 8a7367d7f77ea697c090f5ca4e19669181cc7bcf and version is 1.22.11.5781 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to invoices.php with SQL-like patterns
- Database error logs showing SQL syntax errors
Network Indicators:
- POST requests to /invoices.php containing SQL keywords (SELECT, UNION, etc.)
SIEM Query:
web.url:*invoices.php AND (http.method:POST) AND (web.query:*SELECT* OR web.query:*UNION* OR web.query:*OR*)🔗 References
- https://github.com/anuko/timetracker/commit/8a7367d7f77ea697c090f5ca4e19669181cc7bcf
- https://github.com/anuko/timetracker/security/advisories/GHSA-9g2c-7c7g-p58r
- https://github.com/anuko/timetracker/commit/8a7367d7f77ea697c090f5ca4e19669181cc7bcf
- https://github.com/anuko/timetracker/security/advisories/GHSA-9g2c-7c7g-p58r
