mJobTime SQL Injection Flaw Allows Unauthenticated Remote Code Execution

A critical security vulnerability in mJobTime, a time tracking and workforce management application, allows unauthenticated attackers to execute arbitrary SQL commands and achieve remote code execution on affected servers. The flaw, identified as CVE-2026-9209, has been assigned a CVSS score of 9.3, classifying it as Critical severity.

The vulnerability resides in the Login.aspx admin panel handlers within mJobTime versions up to and including build 15.7.3.32. Specifically, the `runQueryButton` postback and the `exportSqlQuery_Server` PageMethod fail to enforce server-side authentication. Instead, the application relies solely on a client-side `sessionStorage` flag to determine user access. This design flaw permits attackers to submit caller-supplied SQL statements directly to the backing Sybase SQL Anywhere database. These queries are executed with DBA or sysadmin privileges, granting the attacker extensive control over the database environment.

Technical Details and Impact

According to the National Vulnerability Database (NVD) record, the weakness is categorized under CWE-306 (Authentication Bypass) and CWE-250 (Execution with Unnecessary Privileges). The lack of proper server-side validation allows an attacker to invoke dangerous stored procedures such as `xp_cmdshell` and `xp_read_file`.

By leveraging these procedures, an attacker can achieve pre-authentication remote code execution (RCE) as the LocalSystem account. This level of access is achieved through a single HTTP request, making the attack vector both simple and highly effective. The LocalSystem privilege level provides the attacker with the highest level of access on the Windows operating system, potentially allowing them to read, modify, or delete any file on the system, install programs, or view, change, or delete data.

Affected Versions

The vulnerability affects mJob mJobTime software through build 15.7.3.32. Organizations running any version of the software prior to this build number are considered vulnerable. The NVD record does not specify a fixed version, indicating that as of the time of this report, no patched version has been confirmed to resolve the issue.

What should you do?

Security professionals should immediately inventory their environments to identify any instances of mJobTime running versions up to 15.7.3.32. Since no fix has been confirmed yet, organizations should consider isolating affected servers from the internet or restricting access to the Login.aspx endpoints using web application firewalls (WAFs) or network-level access controls. Monitoring for unusual database activity or outbound connections from the mJobTime service may help detect exploitation attempts. Users should await an official patch from the vendor.