Full Report
Vertical-specific construction applications face unique risks. Hacked apps stem from flaws in the software or its components, expanding the jobsite attack surface.
Analysis Summary
# Vulnerability: Blind SQL Injection leading to RCE in Mjobtime Construction Software
## CVE Details
- **CVE ID:** CVE-2025-51683 (and related CVE-2025-51682)
- **CVSS Score:** Not explicitly listed in the text, but typical for RCE via SQLi is **9.8 (Critical)**
- **CWE:** CWE-89 (SQL Injection)
## Affected Systems
- **Products:** Mjobtime (Construction labor and equipment tracking software)
- **Versions:** Version 15.7.2
- **Configurations:** Web-based installations running on Microsoft Internet Information Services (IIS) with a Microsoft SQL Server (MSSQL) database backend.
## Vulnerability Description
The vulnerability is a blind SQL injection flaw located within the web-based interface of the Mjobtime application. Specifically, the application fails to properly sanitize user-supplied input in requests handled by the backend database. Attackers can leverage this flaw to execute arbitrary commands on the underlying operating system by abusing MSSQL features (such as `xp_cmdshell`) or by uploading web shells through the database service. Because the database service often runs with high privileges (e.g., SYSTEM), this leads to full Remote Code Execution (RCE).
## Exploitation
- **Status:** Exploited in the wild. Huntress observed active exploitation incidents in February and December 2025.
- **Complexity:** Low to Medium (standard SQL injection techniques).
- **Attack Vector:** Network (Remote exploitation via HTTP POST requests).
## Impact
- **Confidentiality:** High (Full access to database records and server files).
- **Integrity:** High (Ability to modify data and install malware/toolkits).
- **Availability:** High (Potential for database outages, ransomware, or system wipes).
## Remediation
### Patches
- Users should contact the vendor (Mjobtime) immediately to verify the availability of a security patch for versions beyond 15.7.2.
### Workarounds
- **Disable `xp_cmdshell`:** Ensure that `xp_cmdshell` is disabled on the MSSQL instance if not strictly required for business operations.
- **Principle of Least Privilege:** Run the MSSQL service under a low-privileged service account rather than SYSTEM or Administrator.
- **Web Application Firewall (WAF):** Implement WAF rules to block common SQL injection patterns and suspicious POST requests to the affected endpoint.
## Detection
- **Indicators of Compromise (IoC):**
- Unusual `sqlservr.exe` child processes (e.g., `cmd.exe` or `powershell.exe` being spawned by the SQL process).
- Presence of reverse shells or post-exploitation toolkits (e.g., the "khunt" toolkit).
- **Detection Methods:**
- **Log Analysis:** Monitor IIS web server logs for POST requests directed at:
`hxxps[:]//[domain]/Default.aspx/update_profile_Server`
- **Endpoint Monitoring:** Audit commands executed via MSSQL instances for unauthorized system-level changes.
## References
- **Vendor Website:** hxxps[:]//mjobtime[.]com/
- **Original Research:** hxxps[:]//labs[.]infoguard[.]ch/advisories/cve-2025-51682_cve-2025-51683_time_management_softare_sqli-rce/
- **Huntress Analysis:** hxxps[:]//www[.]huntress[.]com/blog/hacked-construction-apps-bringing-down-jobsite-security
- **NVD Entry:** hxxps[:]//nvd[.]nist[.]gov/vuln/detail/CVE-2025-51683