Description
EfroTech Timetrax是EfroTech公司的一个人力资源管理方案。EfroTech Timetrax 8.3版本存在安全漏洞，该漏洞源于在搜索Web界面中存在未经身份验证的SQL注入漏洞。
EfroTech Timetrax /search.aspx SQL 注入漏洞（CVE-2024-39250）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-39250
https://www.cve.org/CVERecord?id=CVE-2024-39250
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39250.yaml
https://pentest-tools.com/vulnerabilities-exploits/efrotech-timetrax-v83-sql-injection_22978
https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2024-39250
https://access.redhat.com/security/cve/cve-2024-39250
https://www.tenable.com/cve/CVE-2024-39250
https://vuldb.com/?id.272268