WorkTime v118.8 Vulnerability Advisory: RCE, SQLi, LPE, XSS, DoS (CVE-2025-15559 to 15563)

Critical Vulnerability Information Vulnerability Overview 1. Unauthenticated OS Command Injection (CVE-2025-15559) - An unauthenticated attacker can inject OS commands when calling server API endpoints. - The attacker can execute arbitrary commands on the WorkTime server with NT Authority\\SYSTEM privileges. - This allows access to or manipulation of sensitive data, and potentially full server compromise. 2. SQL Injection (MSSQL/Firebird Backend) (CVE-2025-15560) - Attackers with low authentication privileges can inject SQL queries via the WorkTime server API. - If the Firebird database backend is used, attackers can extract all data from the database; if MSSQL is used, attackers can execute arbitrary SQL statements on the backend, leading to sensitive data exposure. 3. Local Privilege Escalation (CVE-2025-15561) - Attackers can exploit the update process of the WorkTime monitoring service to escalate local system privileges to NT Authority\\SYSTEM. 4. Reflected Cross-Site Scripting (XSS) (CVE-2025-15562) - The server API endpoint reflects received data in HTML responses without proper encoding or filtering. - If a victim opens a maliciously crafted URL, arbitrary JavaScript can be executed in the victim’s browser. 5. Broken Access Control Leading to Denial of Service (CVE-2025-15563) - An unauthenticated attacker can send specific HTTP requests to the server to reset the preconfigured WorkTime database, causing service disruption. - No authorization checks are performed. Affected Version WorkersTime v118.8 Vendor Communication Timeline From 2025-07-09 to 2026-02-18. The vendor did not respond to communications; it is unclear whether a patch exists. Remediation Contact the vendor to request a patch. No workarounds are currently available.

Goal Reached Thanks to every supporter — we hit 100%!

WorkTime v118.8 Vulnerability Advisory: RCE, SQLi, LPE, XSS, DoS (CVE-2025-15559 to 15563)