CVE-2023-32306

CRITICAL 9.8CVE-2023-32306 · Published 12/05/2023 · updated 17/06/2026

In short

CVE-2023-32306 is a CRITICAL (CVSS 9.8) vulnerability affecting time tracker (anuko).
Chance of exploitation in the next 30 days (EPSS): 0.72%, higher than 54.0% of all vulnerabilities.
Fix: update to 1.22.13.5792 or later.

Package	Affected versions	Patched versions
time tracker anuko	`< 1.22.13.5792`	`1.22.13.5792`

Description

Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.

References

anuko/timetracker security advisory · Vendor Advisory

More vulnerabilities in time tracker

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

time tracker

anuko

< 1.22.13.5792

1.22.13.5792

Description

More vulnerabilities in time tracker

See all →