CVE-2025-15560: WorkTime Server SQL Injection Vulnerability

CVE-2025-15560 Overview

CVE-2025-15560 is a SQL Injection vulnerability affecting the WorkTime server's "widget" API endpoint. An authenticated attacker with minimal permissions can exploit this flaw to inject malicious SQL queries into the backend database. The impact varies depending on the database backend in use: when Firebird is configured, attackers can retrieve all data from the database; when MSSQL is used, attackers can execute arbitrary SQL statements, potentially gaining access to sensitive data and compromising database integrity.

Critical Impact

Authenticated attackers can exploit SQL injection to extract sensitive data from Firebird databases or execute arbitrary SQL statements on MSSQL backends, potentially leading to complete database compromise.

Affected Products

• WorkTime Server (widget API endpoint)
• WorkTime installations using Firebird database backend
• WorkTime installations using MSSQL database backend

Discovery Timeline

• 2026-02-19 - CVE CVE-2025-15560 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-15560

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The flaw exists in the WorkTime server's "widget" API endpoint, which fails to properly sanitize user-supplied input before incorporating it into SQL queries.

The vulnerability requires authentication but only minimal permissions, significantly lowering the barrier for exploitation. Once authenticated, an attacker can craft malicious input that escapes the intended SQL query context and executes attacker-controlled SQL statements.

The impact severity differs based on the database backend configuration. With Firebird, the exploitation allows data exfiltration from all database tables. With MSSQL, the attack surface is broader—attackers can execute arbitrary SQL statements, potentially enabling not just data theft but also data modification, deletion, or even operating system command execution through SQL Server features like xp_cmdshell if enabled.

Root Cause

The root cause of CVE-2025-15560 is improper input validation and lack of parameterized queries in the widget API endpoint. User-supplied parameters are directly concatenated into SQL query strings without proper sanitization or escaping, allowing attackers to inject SQL syntax that alters the intended query logic.

Attack Vector

The attack vector involves an authenticated request to the WorkTime server's widget API endpoint. An attacker with valid credentials (even low-privilege accounts) can submit specially crafted input containing SQL metacharacters and malicious SQL statements. When processed by the vulnerable endpoint, the injected SQL code is executed against the backend database with the application's database privileges.

For Firebird backends, attackers typically leverage UNION SELECT statements or subqueries to extract data from arbitrary tables. For MSSQL backends, attackers have additional capabilities including stacked queries, which enable multiple SQL statements in a single request, and potential access to extended stored procedures for more severe attacks.

The vulnerability mechanism involves parameter manipulation in API requests to the widget endpoint. Technical details regarding the specific exploitation methodology can be found in the SEC Consult Worktime Analysis.

Detection Methods for CVE-2025-15560

Indicators of Compromise

• Anomalous SQL error messages in application or database logs originating from the widget API endpoint
• Unusual database query patterns including UNION SELECT, OR 1=1, or attempts to access system tables
• Unexpected data access patterns or bulk data retrieval from authenticated sessions with minimal permissions
• Database audit logs showing queries accessing tables beyond the authenticated user's normal scope

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect common SQL injection patterns in requests to the widget API endpoint
• Enable detailed logging on the WorkTime server to capture all requests to the widget API, including full request parameters
• Configure database auditing to track unusual query patterns, especially those accessing sensitive tables or using SQL injection techniques
• Deploy intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Monitor database server CPU and I/O for unusual spikes that may indicate data exfiltration attempts
• Set up alerts for SQL syntax errors or database exceptions originating from the widget API endpoint
• Review authentication logs for accounts with minimal permissions making frequent API requests
• Implement rate limiting on API endpoints to detect and slow automated exploitation attempts

How to Mitigate CVE-2025-15560

Immediate Actions Required

• Restrict access to the WorkTime widget API endpoint to only trusted users and networks until a patch is available
• Implement Web Application Firewall rules to filter SQL injection patterns in requests to the affected endpoint
• Review and minimize user permissions, ensuring principle of least privilege is enforced for all accounts
• Enable enhanced logging and monitoring on the WorkTime server and database backends

Patch Information

Consult the vendor or the SEC Consult Worktime Analysis for the latest patch information and security updates addressing this vulnerability. Apply vendor-provided patches as soon as they become available.

Workarounds

• Deploy a Web Application Firewall (WAF) in front of the WorkTime server configured with SQL injection detection rules
• Implement network segmentation to restrict access to the widget API endpoint from untrusted networks
• Consider temporarily disabling the widget API functionality if it is not business-critical
• Apply database-level restrictions to limit the WorkTime application's database user privileges to only necessary operations

# Example WAF rule to block common SQL injection patterns (ModSecurity)
# Add to your ModSecurity configuration
SecRule ARGS "@detectSQLi" \
    "id:1001,\
    phase:2,\
    block,\
    msg:'SQL Injection Attack Detected on Widget API',\
    logdata:'Matched Data: %{MATCHED_VAR}',\
    severity:'CRITICAL',\
    chain"
    SecRule REQUEST_URI "@contains /widget" \
        "t:lowercase"