CVE-2026-9209
CriticalCVSS 9.8Summary
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
Risk Assessment
The risk is critical because an unauthenticated attacker can gain full control of the system by executing code with LocalSystem privileges, potentially leading to complete compromise of confidentiality, integrity, and availability.
Recommendation
Immediately update mJobTime to the latest version if available, and restrict access to the admin panel to trusted networks only. Additionally, enforce server-side authentication for all endpoints.
Other vulnerabilities in mJobTime
See all- CVE-2025-51683Critical
A blind SQL injection vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/update_profile_Server endpoint.
- CVE-2025-51682Critical
The vulnerability in mJobtime 15.7.2 handles authorization on the client side, allowing an attacker to modify client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative functions directly.
Original NVD description (English source)
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS