CVE-2025-59920: time@work SQL Injection Vulnerability

CVE-2025-59920 Overview

A blind authenticated SQL injection vulnerability exists in time@work version 7.0.5. When hours are entered in the application, it performs a query to display projects assigned to the user. If the query URL is copied and opened in a new browser window, the IDClient parameter is vulnerable to blind SQL injection. When exploited by users with the TWAdmin account that has the sysadmin role enabled, this vulnerability allows command execution on the underlying system. Users without the sysadmin role can still query and exfiltrate data from the database.

Critical Impact

This SQL injection vulnerability enables authenticated attackers to execute arbitrary commands on the system when exploited with sysadmin privileges, or extract sensitive database information with lower privileges.

Affected Products

• time@work version 7.0.5

Discovery Timeline

• 2026-02-18 - CVE-2025-59920 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-59920

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), a critical class of web application vulnerabilities that occurs when user-supplied input is improperly sanitized before being incorporated into SQL queries. The IDClient parameter in time@work fails to properly validate or sanitize user input, allowing attackers to inject arbitrary SQL commands.

The blind nature of this SQL injection means that while the application does not directly return query results to the attacker, exploitation is still possible through inference-based techniques. Attackers can extract data character by character using boolean-based or time-based blind SQL injection methods.

The severity escalates significantly based on user privileges. When the TWAdmin user account with sysadmin database role is compromised or used maliciously, the attacker can leverage SQL Server's extended stored procedures (such as xp_cmdshell) to execute operating system commands, potentially leading to complete system compromise.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the time@work application. The IDClient parameter value is directly concatenated into SQL statements without sanitization, escaping, or the use of prepared statements. This allows attackers to break out of the intended query context and inject malicious SQL code.

Attack Vector

The attack is network-based and requires authentication to the time@work application. An authenticated attacker must navigate to the hours entry functionality and manipulate the IDClient parameter in the resulting query URL. The attack can be performed by copying the legitimate query URL, modifying the IDClient parameter to include SQL injection payloads, and opening the crafted URL in a new browser window.

The exploitation complexity depends on the attacker's database privileges. Users with sysadmin role can achieve remote code execution, while standard users are limited to data extraction through blind SQL injection techniques such as time-based delays or conditional responses.

Detection Methods for CVE-2025-59920

Indicators of Compromise

• Unusual SQL error messages or timeout delays in application responses when accessing project-related functionality
• Web server logs showing requests with suspicious SQL syntax in the IDClient parameter (e.g., WAITFOR DELAY, UNION SELECT, or single quotes)
• Database audit logs revealing unexpected queries from the time@work application context
• Evidence of xp_cmdshell execution or other extended stored procedure usage from application database connections

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in HTTP parameters
• Enable database activity monitoring to alert on suspicious query patterns, especially those involving system stored procedures
• Review IIS or web server access logs for anomalous request patterns targeting time@work URLs with modified parameters
• Deploy endpoint detection and response (EDR) solutions to identify command execution attempts originating from database processes

Monitoring Recommendations

• Enable verbose logging for the time@work application to capture all parameter values in requests
• Configure database auditing to track all queries executed by the application service account
• Monitor for outbound network connections from the database server that could indicate data exfiltration
• Set up alerts for any execution of xp_cmdshell or similar dangerous stored procedures

How to Mitigate CVE-2025-59920

Immediate Actions Required

• Restrict access to the time@work application to only essential personnel until patches are applied
• Remove sysadmin privileges from the database account used by the application to limit potential impact
• Implement network segmentation to isolate the database server from direct internet access
• Deploy WAF rules to filter SQL injection attack patterns targeting the IDClient parameter

Patch Information

Refer to the INCIBE Security Notice for official vendor guidance and patch availability. Contact the time@work vendor (SystemsWork) directly for the latest security updates addressing this SQL injection vulnerability.

Workarounds

• Disable or restrict access to the hours entry functionality until a patch is available
• Implement input validation at the web server or reverse proxy level to reject requests with suspicious characters in the IDClient parameter
• Use database connection strings with minimal required privileges, ensuring the application account does not have sysadmin rights
• Consider implementing additional authentication layers or IP restrictions for administrative functionality

# Example: Disable xp_cmdshell to limit RCE impact (SQL Server)
# Connect to SQL Server and execute:
# EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
# EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;

# Example: Restrict application database user privileges
# REVOKE EXECUTE ON xp_cmdshell FROM [AppDatabaseUser];
# ALTER SERVER ROLE sysadmin DROP MEMBER [AppDatabaseUser];