CVE-2026-9209 in Time
Summary
by MITRE • 10/08/2026
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in mJobTime prior to build 15.7.3.32 represents a critical failure in authentication logic within the administrative interface of the application. Specifically, the Login.aspx page contains handlers for the runQueryButton postback and the exportSqlQuery_Server PageMethod that are designed to execute SQL queries against an underlying Sybase SQL Anywhere database. The core flaw lies in the absence of server-side authentication enforcement for these specific endpoints. Instead of validating user credentials or session tokens on the backend, the application relies exclusively on a client-side sessionStorage flag to determine access permissions. This architectural decision creates a severe security gap because client-side state can be trivially manipulated by an attacker using standard web debugging tools or custom HTTP clients, effectively bypassing all intended authentication controls and granting unauthenticated access to sensitive database operations.
The technical nature of this flaw is classified as SQL injection leading to remote code execution. Because the application executes caller-supplied input directly within SQL statements without adequate sanitization or parameterization, an attacker can inject malicious payloads into the query parameters. The severity is exacerbated by the fact that these queries are executed with DBA or sysadmin privileges on the Sybase database engine. This high level of privilege allows the injected code to invoke extended stored procedures such as xp_cmdshell and xp_read_file. These system-level functions provide direct access to the operating system shell and file system, respectively. Consequently, an attacker does not merely gain read-only access to sensitive data but can achieve full pre-authentication remote code execution on the host machine running the database service, typically under the context of LocalSystem or equivalent high-privilege accounts depending on the deployment configuration.
From a threat modeling perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and CWE-287 Improper Authentication. The exploitation path is further characterized by ATT&CK technique T1059 Command and Scripting Interpreter for executing system commands via xp_cmdshell, as well as T1003 OS Credential Dumping if the attacker leverages database privileges to extract credentials from memory or configuration files using xp_read_file. The impact of this vulnerability is catastrophic, allowing an unauthenticated remote actor to take complete control of the server hosting the mJobTime application and its associated Sybase SQL Anywhere instance. This can lead to total data compromise, including theft of customer records, financial information, and proprietary business logic stored within the database, as well as potential lateral movement across the internal network if the LocalSystem account has broader access rights.
Mitigation strategies must address both the immediate technical flaw and the underlying architectural weaknesses. The most effective remediation is to immediately upgrade mJobTime to version 15.7.3.4 or later where this vulnerability has been patched by implementing proper server-side authentication checks for all administrative endpoints, including runQueryButton and exportSqlQuery_Server. In addition to upgrading, organizations should enforce strict input validation and use parameterized queries to prevent SQL injection regardless of the execution context. It is also critical to remove reliance on client-side security controls such as sessionStorage flags for authorization decisions; instead, authentication and authorization must be validated server-side using secure session management practices. Furthermore, database accounts running administrative tasks like DBA or sysadmin should follow the principle of least privilege where possible, although in legacy systems this may require compensating controls such as network segmentation to restrict access to the database port from untrusted networks until patches are applied.