IT SBIT Services
Schneeberger
DEEN
CVE tracker

mJobTime: Unauthenticated SQL execution leading to remote code execution

CVE-2026-9209Critical 9.3

← All vulnerabilities

Summary

mJobTime through build 15.7.3.32 exposes SQL execution handlers on the Login.aspx admin panel without server-side authentication. An unauthenticated attacker can send a single HTTP request that runs arbitrary SQL with DBA/sysadmin rights on the backing Sybase SQL Anywhere database, and can use it to invoke OS commands as LocalSystem. Exposure depends on whether the web application is reachable from untrusted networks.

Affected

  • mJob mJobTime, versions 0 to and including 15.7.3.32
  • Default configuration is affected according to the researchers.

Fixed in

Unknown. The vendor has stated the issue is resolved in build 15.7.3, but researchers reported that this build remains exploitable, so no verified fixed version is available.

Workaround

  • Restrict network access to the mJobTime web tier to authorized users only (VPN, IP allowlist or authenticating reverse proxy).
  • Remove the Login.aspx handlers from direct internet exposure, or disable them at IIS level if possible.
  • Run the database connection with a least-privileged account instead of a sysadmin login.
  • Add WAF rules as a temporary compensating control only.

Exploitation

  • Public proof-of-concept: none found; VulDB states no exploit is available.
  • A detailed technical write-up by Sprocket Security has been published.
  • No evidence of exploitation in the wild found at the time of writing; CISA KEV listing not confirmed.
  • A related earlier CVE in the same product (CVE-2025-51683) is reported as exploited in the wild.
  • CISA SSVC: exploitation status PoC, automatable yes, technical impact total.

Our recommendation

  • Check whether mJobTime is in use and which build is installed, and whether Login.aspx is reachable from the internet.
  • Immediately restrict access to the web tier to authorized users (VPN, IP allowlist or authenticating reverse proxy).
  • Do not rely on the vendor's build 15.7.3 as a fix until the vendor confirms it in writing.
  • Review IIS and web logs for POST requests to Login.aspx; if the application was internet-facing, check for new accounts, services, scheduled tasks and unexpected outbound connections.
  • Monitor NVD, CISA KEV and the vendor for updates.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:58.

Original description (NVD)

mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed