c0gnit00/CVE-2022-24707

PoC

POC for CVE-2022-24707, an authenticated SQL injection in Anuko Time Tracker’s Puncher plugin before 1.20.0.5642, caused by an unsanitized date POST parameter. It allows UNION-based and time-based blind SQL injection, enabling a logged-in user to dump the database

view exploit source poc_in_githubauthor c0gnit00published 2026-10-23catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2022-24707UShigh8.8Exploit
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker…
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan