Read the docs
TI-2021-19657 Aliases CVE-2021-43851

SQL injection vulnerability in anuko timetracker

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is posted along when navigating between organizational subgroups (groups.php file). Status parameter is used in multiple files to change a status of an entity such as making a project, task, or user inactive. This issue has been patched in version 1.19.33.5607. An upgrade is highly recommended. If an upgrade is not practical, introduce ttValidStatus function as in the latest version and start using it user input check blocks wherever status field is used. For groups.php fix, introduce ttValidInteger function as in the latest version and use it in the access check block in the file.

Why it matters now

EPSS 0.01203 68th percentileScored 2026-11-07
Fix Fixed timetracker (anuko): 1.19.33.5607

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
anukotimetrackerbefore 1.19.33.56071.19.33.5607Patch availableCNA
  • timetracker Vendoranuko Affected before 1.19.33.5607 Fixed in 1.19.33.5607 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*before 1.19.33.5607Vulnerableanuko
  • cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:* Versions before 1.19.33.5607 Vulnerable ·anuko

Remediation

  • Fix · CNA timetracker (anuko) Fixed in 1.19.33.5607

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43851

References

Patch 2

Advisory 1

  • TI-2022-08522 SQL injection in anuko timetracker CVSS 3.1HIGH 8.8
  • TI-2020-16665 In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't… CVSS 3.1CRITICAL 9.8
  • TI-2023-15602 SQL Injection Vulnerability in anuko timetracker CVSS 3.1CRITICAL 9.8
  • TI-2023-15600 Time Tracker has Blind SQL Injection Vulnerability in Reports CVSS 3.1CRITICAL 9.8
  • TI-2020-12027 CSV injection in Anuko Time Tracker CVSS 3.1HIGH 8.7
  • TI-2021-04452 Predictable tokens used for password resets CVSS 3.1CRITICAL 9.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences