Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260218-0",
          "vendor": "Nestersoft",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260218-0 \u003e\n=======================================================================\n             title: Multiple Critical Vulnerabilities\n           product: NesterSoft WorkTime (on-prem/cloud)\nvulnerable version: \u003c= 11.8.8\n     fixed version: No patch available, vendor unresponsive.\n        CVE number: CVE-2025-15563, CVE-2025-15562, CVE-2025-15561\n                    CVE-2025-15560, CVE-2025-15559\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 impact: Critical\n          homepage:https://www.worktime.com/\n             found: 2025-05-22\n                by: Tobias Niemann (Office Bochum)\n                    Daniel Hirschberger\n                    Thorger Jansen (Office Bochum)\n                    Marius Renner (Office Berlin)\n                    SEC Consult Vulnerability Lab\n\n                    An integrated part of SEC Consult, an Atos business\n                    Europe | Asia\n\n                    https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"WorkTime is a green employee monitoring software with a primary focus on\nmonitoring employees\u0027 productivity. It is a non-invasive, transparent, safe,\nand socially responsible technology. WorkTime offers a safe replacement for\nevery invasive function.\"\n\nSource:https://www.worktime.com/employee-monitoring\n\n\nBusiness recommendation:\n------------------------\nThe vendor did not respond to our communication attempts anymore. It is currently\nunclear, whether a patch is available. Please contact the vendor to request a\npatch for the identified critical security issues.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Unauthenticated OS Command Injection (CVE-2025-15559)\nAn unauthenticated attacker can inject OS commands when calling a server API\nendpoint. This allows an attacker to execute arbitrary commands on the\nWorkTime server as NT Authority\\SYSTEM with the highest privileges. Attackers\nare able to access or manipulate sensitive data and take over the whole\nserver.\n\n2) SQL Injection (MSSQL/Firebird Backend) (CVE-2025-15560)\nAn authenticated attacker with minimal permissions can exploit a SQL injection\nin a WorkTime server API endpoint to inject SQL queries. If the Firebird\nbackend is used, attackers are able to retrieve all data from the database backend.\nIf the MSSQL backend is used the attacker can execute arbitrary SQL statements\non the database backend and gain access to sensitive data.\n\n3) Local Privilege Escalation (CVE-2025-15561)\nAn attacker can exploit the update behavior of the WorkTime monitoring daemon\nto elevate privileges on the local system to NT Authority\\SYSTEM.\n\n4) Reflected Cross-Site Scripting (XSS) (CVE-2025-15562)\nA server API endpoint reflects received data into the HTML response without\napplying proper encoding or filtering. This allows an attacker to execute\narbitrary JavaScript in the victim\u0027s browser if the victim opens a URL prepared\nby the attacker.\n\n5) Broken Access Control results in Denial of Service (CVE-2025-15563)\nAny unauthenticated user can reset the WorkTime on-prem database configuration\nby sending a specific HTTP request to the WorkTime server. No authorization check is\napplied here.\n\n\nProof of concept:\n-----------------\n1) Unauthenticated OS Command Injection (CVE-2025-15559)\nThe server API call to generate and download the WorkTime client from the\nWorkTime server is vulnerable against OS command injection in the \"guid\"\nparameter. For this proof of concept the following OS command is injected:\n--------------------------------------------------------------------------------\nwhoami \u003e C:\\secwashere\n--------------------------------------------------------------------------------\nThe HTTP request is shown below:\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nThe injected command is executed on the server as NT Authority\\SYSTEM:\n\u003ccommand_injection.png\u003e\n\n\n2) SQL Injection (MSSQL/Firebird Backend) (CVE-2025-15560)\nThe following authenticated \"widget\" API endpoint is vulnerable. Minimal\npermissions are required to access the server endpoint.\n--------------------------------------------------------------------------------\nPOST /api/widget HTTP/1.1\nHost: \u003cserver_hostname\u003e:8080\nContent-Type: multipart/form-data; boundary=---------------------------295635091325610060643320064167\nContent-Length: [...]\n-----------------------------295635091325610060643320064167\n\u003c removed \u003e\n-----------------------------295635091325610060643320064167--\n--------------------------------------------------------------------------------\n\nNote that the request requires a token value in the request body.\nAny user that has access to the WorkTime server in any role has access to a\nvalid token. The three parameters employee, computer and department are injectable.\nIf the Firebird database backend is configured, the injection can be exploited\nusing the following sqlmap command:\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nIf the MSSQL backend is used the following sqlmap command can be used\nwith the request from above:\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nDepending on the used MSSQL database user and the database configuration\nthe injection can also be exploited to execute OS commands on the server.\n\n\n3) Local Privilege Escalation (CVE-2025-15561)\nTo exploit the vulnerability, the attacker must first create an executable that\nshould be executed with elevated privileges. For this proof of concept the\nfollowing C code was used.\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nIt is required to add versioning information during the linking process.\nOtherwise WorkTime will not execute the created binary. Any resource file can be\nused:\n--------------------------------------------------------------------------------\n1 VERSIONINFO\nFILEVERSION 1,0,0,0\nPRODUCTVERSION 1,0,0,0\nFILEFLAGSMASK 0x3f\nFILEFLAGS 0x0\nFILEOS 0x40004\nFILETYPE 0x1\nFILESUBTYPE 0x0\nBEGIN\n    BLOCK \"StringFileInfo\"\n    BEGIN\n        BLOCK \"040904b0\"  // Language and code page\n        BEGIN\n            VALUE \"CompanyName\", \"Your Company\"\n            VALUE \"FileDescription\", \"Your Application Description\"\n            VALUE \"FileVersion\", \"1.0.0.0\"\n            VALUE \"InternalName\", \"YourApp\"\n            VALUE \"OriginalFilename\", \"YourApp.exe\"\n            VALUE \"ProductName\", \"Your Product\"\n            VALUE \"ProductVersion\", \"1.0.0.0\"\n        END\n    END\n    BLOCK \"VarFileInfo\"\n    BEGIN\n        VALUE \"Translation\", 0x409, 1200\n    END\n--------------------------------------------------------------------------------\n\nCompile the PoC code:\n--------------------------------------------------------------------------------\n$ x86_64-w64-mingw32-windres resource.rc -o resource.o\n$ x86_64-w64-mingw32-gcc exec.c resource.o\n--------------------------------------------------------------------------------\n\nThe resulting executable must now be renamed to WTWatch.exe and be dropped\nin C:\\ProgramData\\wta\\ClientExe.\n\nThe folder is writable by Everyone:\n\u003cfolder_permissions.png\u003e\n\nAfter dropping the executable, it is executed by the WorkTime monitoring daemon\nas NT Authority\\SYSTEM:\n\u003cpriv_esc.png\u003e\n\n\n4) Reflected Cross-Site Scripting (XSS) (CVE-2025-15562)\nAs a proof of concept the following JavaScript payload was used:\n--------------------------------------------------------------------------------\nalert(document.location)\n--------------------------------------------------------------------------------\n\nThe type parameter in the POST body is reflected back into the HTML response:\n--------------------------------------------------------------------------------\nPOST /report/internet/urls HTTP/1.1\nHost: \u003cserver_hostname\u003e:8079\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nCookie: PHPSESSID=[...]; aup_accept=accept\ntype=\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\n--------------------------------------------------------------------------------\nThe injected payload is reflected back into the HTTP response without proper\nencoding or filtering and the payload is executed:\n\u003cxss.png\u003e\n\n\n5) Broken Access Control results in Denial of Service (CVE-2025-15563)\nAn unauthenticated attacker can access the following URL to reset the\nserver\u0027s configured database.\n\u003c PoC URL removed \u003e\n\nIf the attacker presses the displayed button the browser sends the following\nunauthenticated HTTP request which resets the database configuration:\n--------------------------------------------------------------------------------\n\u003c Poc removed \u003e\n--------------------------------------------------------------------------------\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* WorkTime v11.8.8\n\n\nVendor contact timeline:\n------------------------\n2025-07-09: Initial mail to the vendor (info () worktime com)\n2025-07-23: First vendor response, requesting unencrypted advisory.\n2025-07-29: Sending the advisory via email.\n2025-09-29: Asking for a status update regarding any fixes or roadmap, asking\n            whether we should reserve CVE numbers or the vendor.\n2025-09-30: Customer support answers that \"Firebird for On-Premises\" (CVE-2025-24975)\n            is fixed. They ask us which other CVEs we have identified.\n2025-10-02: Replying to vendor that we submitted the advisory including all details\n            on 29th July and that CVE-2025-24975 has nothing to do with our advisory.\n            No response.\n2025-11-03: Asking the vendor for a status update, informing them about our disclosure\n            deadline again and setting preliminary release date to 19th November.\n2025-11-03: Vendor support responds to check with the technical team.\n2025-11-17: Vendor responds they are actively working on it this week to analyze\n            the issues and report back to us within a week.\n2026-02-04: No response from the vendor so far. Reserved CVE numbers, asking for\n            status update / fixed version numbers, informing vendor about planned\n            public release on 18th February.\n2026-02-18: Still no response, public release of advisory.\n\n\nSolution:\n---------\nThe vendor did not respond to our communication attempts anymore. It is currently\nunclear, whether a patch is available. Please contact the vendor to request a\npatch for the identified critical security issues.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to wo"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:40:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/31"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/31"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.worktime.com/"
        },
        {
          "url": "https://www.worktime.com/employee-monitoring"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/31"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260218-0 :: Multiple Critical Vulnerabilities in NesterSoft WorkTime (on-prem/cloud)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-15559",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15560",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15561",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15562",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15563",
              "type": "related"
            },
            {
              "destId": "CVE-2025-24975",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0228",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/31",
            "automated": true,
            "contentSha256": "d62d24712977ac958ebaeb4265f410481e4b5d447d9dd58f15c59a9e39a78d89",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/31",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-18T11:52:03Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0228"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-09T13:40:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0228"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}