Read the docs
TI-2022-08522 Aliases CVE-2022-24707

SQL injection in anuko timetracker

Priority HIGH 71CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.07159 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed timetracker (anuko): 1.20.0.5642

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
anukotimetrackerbefore 1.20.0.56421.20.0.5642Patch availableCNA
  • timetracker Vendoranuko Affected before 1.20.0.5642 Fixed in 1.20.0.5642 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*before 1.20.0.5642Vulnerableanuko
  • cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:* Versions before 1.20.0.5642 Vulnerable ·anuko

Remediation

  • Fix · CNA timetracker (anuko) Fixed in 1.20.0.5642

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24707

References

Exploit 1

Patch 1

Advisory 1

  • TI-2020-16665 In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't… CVSS 3.1CRITICAL 9.8
  • TI-2023-15602 SQL Injection Vulnerability in anuko timetracker CVSS 3.1CRITICAL 9.8
  • TI-2023-15600 Time Tracker has Blind SQL Injection Vulnerability in Reports CVSS 3.1CRITICAL 9.8
  • TI-2020-12027 CSV injection in Anuko Time Tracker CVSS 3.1HIGH 8.7
  • TI-2021-04452 Predictable tokens used for password resets CVSS 3.1CRITICAL 9.1
  • TI-2020-16666 Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which… CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences