Single Request Triggers Full System Takeover in mJobTime via SQLi in Login.aspx Up to Build 15.7.3.32

A critical security flaw in mJobTime allows attackers to take full control of affected servers without logging in. The vulnerability, tracked as CVE-2026-9209, resides in the application’s administrative login interface and has been rated 9.3 on the Common Vulnerability Scoring System. This high severity score reflects the ease with which an attacker can exploit the issue to run commands on the host machine.

The problem stems from how the application handles SQL queries in its `Login.aspx` handlers. Specifically, the `runQueryButton` postback and the `exportSqlQuery_Server` PageMethod process input from users without proper validation. Because the application relies on a client-side `sessionStorage` flag for authentication rather than server-side checks, anyone who can reach these endpoints can bypass login requirements entirely.

In plain English

Imagine a secure building where the guard only checks if you have a sticker on your hand before letting you into the server room. If you can just put that sticker on yourself, you get in. That is essentially what is happening here. The mJobTime application uses a web page called `Login.aspx` to manage administrative tasks. Normally, this page should require a username and password. However, the code that processes actions on this page, such as running database queries, does not actually verify if the person sending the request is authorized.

An attacker does not need to guess a password. They can simply send a specially crafted web request to the server. This request contains SQL commands that the database executes immediately. Because the database runs with high-level administrative privileges (DBA/sysadmin), the commands have full power over the system.

The background

The vulnerability affects mJobTime through build version 15.7.3.32. The underlying database engine is Sybase SQL Anywhere. The National Vulnerability Database lists the weakness as involving broken access control (CWE-306) and execution with unnecessary privilege (CWE-250).

The danger lies in the specific capabilities of the database. Because the SQL injection occurs with DBA privileges, an attacker can invoke stored procedures like `xp_cmdshell` and `xp_read_file`. These procedures allow the execution of operating system commands and the reading of files on the server. Consequently, a single HTTP request from an attacker can result in remote code execution as the LocalSystem account, which is the highest privilege level on a Windows system.

What changes now

Organizations using mJobTime must immediately verify their version numbers. If they are running build 15.7.3.32 or earlier, they are exposed to this critical flaw. Security teams should monitor network traffic for unusual SQL-related requests to the `Login.aspx` endpoint, as this could indicate an attempted exploit.

No patch or update has been confirmed yet by the vendor. Until a fix is released, administrators may need to consider restricting access to the administrative interface from external networks to reduce the attack surface.

Background: SQL injection

Look for unexpected database errors, slow page loads, or logic bypasses. Check logs for tautologies and comment characters. Isolate affected inputs immediately and review parameterized query implementation.

Read the full guide: SQL Injection Warning Signs: Detecting Data Breaches Early

What to do and how to stay safe: mJobTime

• Check the version of mJobTime installed on your servers and compare it to the affected build 15.7.3.32.
• Restrict network access to the mJobTime administrative interface so it is not reachable from the public internet.
• Monitor server logs for unexpected SQL execution or calls to `xp_cmdshell` from the application.
• Once the vendor provides an update, apply it immediately to resolve the vulnerability.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-9209?

It is a critical SQL injection vulnerability in mJobTime that allows unauthenticated remote code execution.

Which versions of mJobTime are affected?

All versions up to and including build 15.7.3.32 are affected by this flaw.

How severe is this vulnerability?

It has a CVSS score of 9.3, which is rated as critical, due to the potential for full system compromise.