TimeClock Software SQL Injection Vulnerability Allowing Username Enumeration

A time-based SQL injection vulnerability has been identified in TimeClock Software version 1.01. This vulnerability allows authenticated attackers to enumerate valid usernames by manipulating the 'notes' parameter in the add_entry.php endpoint. By injecting conditional time delays, attackers can measure response time differences to determine the existence of usernames.

Impact

Exploitation of this vulnerability could lead to unauthorized enumeration of usernames, potentially allowing for further attacks such as password guessing or phishing.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the add_entry.php endpoint. Inject a payload into the 'notes' parameter that includes a time-based conditional SQL injection. Measure the response time to determine if the username exists.