CVE-2010-0122 Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) auth.php or (b...
HighCVSS 7.5
EPSS 2.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) auth.php or (b) login_action.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| timeclock-software employee timeclock software | = 0.99 | No fix listed |
References
- 38739 third-party-advisory vendor-advisory
- secunia.com vendor-advisory
- 62831 vdb-entry
- 62832 vdb-entry
- 20100310 Secunia Research: Employee Timeclock Software SQL Injection Vulnerabilities mailing-list
- 38639 vdb-entry
- timeclock-auth-sql-injection(56799) vdb-entry