Times Software E-Payroll Denial-of-Service and Potential SQL Injection Vulnerability

A vulnerability in Times Software E-Payroll has been identified, where a POST parameter used during the login process is not properly sanitized. This flaw allows an unauthenticated attacker to conduct denial-of-service attacks. While SQL injection may also be possible, creating a functional exploit has been hindered by likely backend filtering. Additionally, attempts at command injection result in detailed error messages that reveal information about the internal infrastructure.

Impact

Exploitation of this vulnerability can lead to denial-of-service conditions. According to CERT Polska, the vulnerability also allows for command injection, with the application disclosing internal infrastructure details through error messages.