mJobTime SQL Flaw Grants LocalSystem Access Without Authentication
A critical vulnerability in mJobTime allows attackers to execute arbitrary code on the server as LocalSystem via a single HTTP request.
Key points
- The flaw affects mJobTime versions up to and including build 15.7.3.32.
- Attackers can exploit unauthenticated SQL execution in admin panel handlers.
- No server-side authentication is enforced beyond a client-side session flag.
Organisations running mJobTime face immediate risk from a critical security flaw that permits unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-9209, allows attackers to take full control of the underlying server infrastructure without needing valid credentials.
How does the vulnerability work?
The issue resides within the Login.aspx admin panel handlers of the mJobTime application. Specifically, two endpoints are vulnerable: the runQueryButton postback and the exportSqlQuery_Server PageMethod. These components execute SQL queries supplied directly by the caller against the backing Sybase SQL Anywhere database.
Crucially, these operations are performed using DBA or sysadmin privileges. The application fails to enforce server-side authentication for these actions, relying instead on a client-side sessionStorage flag. This design flaw means an attacker can submit arbitrary SQL commands through these exposed endpoints without being logged in.
What can an attacker achieve?
By exploiting this SQL injection vulnerability, an attacker can invoke powerful stored procedures such as xp_cmdshell and xp_read_file. This capability enables pre-authentication remote code execution (RCE) as the LocalSystem account.
According to the NVD record, this level of access can be achieved via a single HTTP request. The CVSS score for CVE-2026-9209 is 9.3, rated as Critical. The weaknesses associated with this flaw are identified as CWE-306 (Missing Authentication for Critical Function) and CWE-250 (Execution with Unnecessary Privileges).
Which components are affected?
The vulnerability affects mJobTime software through build 15.7.3.32. Any installation running this version or earlier is susceptible to the attack. The flaw is intrinsic to the way the application handles SQL execution within its administrative interfaces, specifically targeting the Sybase SQL Anywhere database backend.
What should organisations do now?
As no patch or fix has been confirmed yet in the available source material, immediate mitigation is essential for affected systems. IT managers should verify their current mJobTime build version. If running version 15.7.3.32 or earlier, organisations should consider isolating the application from untrusted networks or restricting access to the Login.aspx handlers to trusted IP addresses only, if possible.
Frequently asked questions
What is the CVSS score for CVE-2026-9209?
The CVSS score is 9.3, which is rated as Critical.
Does this vulnerability require authentication?
No, it is an unauthenticated vulnerability that can be exploited via a single HTTP request.
Which database is targeted by this flaw?
The vulnerability targets the backing Sybase SQL Anywhere database.
