Description
mJobtime 是一款用于项目管理和时间跟踪的软件。该漏洞存在于 /Default.aspx/update_profile_Server 接口，攻击者可以通过发送特制的 JSON 数据包，利用 SQL 注入和命令执行的组合漏洞，执行任意系统命令，从而完全控制受影响的服务器。
mJobtime /Default.aspx/update_profile_Server 命令执行漏洞（CVE-2025-51683）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-51683
https://labs.infoguard.ch/advisories/cve-2025-51682_cve-2025-51683_time_management_softare_sqli-rce/
https://www.sentinelone.com/vulnerability-database/cve-2025-51683/
https://github.com/advisories/GHSA-gp72-w5fg-q33m
https://cybersecuritynews.com/attackers-exploiting-mjobtime-app-vulnerability/
https://www.gm7.org/archives/35224
https://www.huntress.com/blog/hacked-construction-apps-bringing-down-jobsite-security
https://www.ctrlaltnod.com/news/critical-sql-injection-flaw-found-in-mjobtime-posing-major-risks/
https://app.opencve.io/cve/?vendor=mjobtime
https://www.tenable.com/cve/CVE-2025-51683