eTimeTrackLite Web Permission Control Flaw Allowing Unauthorized Database Configuration Modifications

A permission control vulnerability has been identified in eTimeTrackLite Web versions through 12.0 (20250704). This flaw allows unauthorized attackers to access specific routes and alter database connection settings. The vulnerability could be exploited remotely, potentially bypassing the application's login process.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in database connection configurations, allowing attackers to manipulate how the application interacts with its database.

Reproduction

To reproduce this vulnerability, access the '/admin/DBSettings.aspx' route without proper authorization. Once on the page, unauthorized changes can be made to the database connection settings, which will be applied without any verification or authentication.