mJobTime SQL Injection Leading to RCE (CVE-2025-51682/83) Analysis

Key Information Summary Vulnerability Overview CVE ID: CVE-2025-51682, CVE-2025-51683 Vulnerability Type: Time Management Software SQLi-RCE Risk Level: High Discoverer: Dario Weiss Vulnerability Details Description: A recent external penetration test identified two vulnerabilities in a web application. These vulnerabilities allow unauthorized access to sensitive functionalities, including reading logs, modifying configurations, executing arbitrary SQL statements, and performing SQL injection attacks. These flaws ultimately led to remote code execution (RCE) and exposure of sensitive information. Impact: Potential for remote code execution and sensitive information disclosure. Disclosure Timeline Technical Details Login Interface: The application provides only a single login screen. Frontend Code Analysis: Discovered interesting endpoints and behaviors, such as checking if username is set to SUPERVISOR. SQL Injection: By setting username to SUPERVISOR, access to was possible without successful login, allowing retrieval of all usernames and other information. Hidden Menu: Pressing reveals a hidden menu prompting for an authentication token. Although server responded with failure message, intercepting and modifying the request successfully granted access to the admin interface. Emergency Update: The software vendor prepared an emergency update, but sensitive information such as log files remained accessible after the update. Additional Details Configuration Update: The application’s configuration tab displays web application settings, including the default database password. SQL Injection: Successful execution of commands via SQL injection, such as listing directory contents and performing ping operations.

Goal Reached Thanks to every supporter — we hit 100%!

mJobTime SQL Injection Leading to RCE (CVE-2025-51682/83) Analysis