CVE-2025-59920
Received Received - Intake

Blind SQL Injection in time@work 7.0.5 Enables Remote Code Execution

Publication date: 2026-02-18

Last updated on: 2026-02-18

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in a new browser window, the ‘IDClient’ parameter is vulnerable to a blind authenticated SQL injection. If the request is made with the TWAdmin user with the sysadmin role enabled, exploiting the vulnerability will allow commands to be executed on the system; if the user does not belong to the sysadmin role, they will still be able to query data from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-18
Last Modified
2026-02-18
Generated
2026-07-28
AI Q&A
2026-02-18
EPSS Evaluated
2026-07-26
NVD
CVE-2025-59920
EUVD
EUVD-2025-207839

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
systems@work time@work to 8.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-59920 is a high-severity blind authenticated SQL injection vulnerability in time@work version 7.0.5, a software used for tracking hours worked on projects.

The vulnerability occurs in the ‘IDClient’ parameter of a query URL that displays projects assigned to a user. If this URL is copied and opened in a new browser window, the parameter can be exploited to perform SQL injection.

Exploitation requires authentication. If the attacker uses a TWAdmin user with sysadmin privileges, they can execute arbitrary system commands. If the user does not have sysadmin privileges, they can still extract data from the database.

Detection Guidance

[{'type': 'paragraph', 'content': "The vulnerability affects the 'IDClient' parameter in the query URL used by time@work version 7.0.5. Detection involves identifying blind authenticated SQL injection attempts on this parameter."}, {'type': 'paragraph', 'content': "Since exploitation requires authentication, monitoring authenticated requests to the application for unusual or malformed queries targeting the 'IDClient' parameter can help detect attempts."}, {'type': 'paragraph', 'content': 'No specific commands or detection tools are provided in the available information.'}] [1]

Impact Analysis

This vulnerability can have serious impacts depending on the privileges of the attacker.

  • If exploited by a user with sysadmin privileges, arbitrary system commands can be executed, potentially leading to full system compromise.
  • If exploited by a user without sysadmin privileges, sensitive data can be extracted from the database, leading to data breaches.
Compliance Impact

I don't know

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The vulnerability was resolved by systems@work in version 8.0.4 of time@work.'}, {'type': 'paragraph', 'content': 'Immediate mitigation steps include upgrading time@work from version 7.0.5 to version 8.0.4 or later.'}, {'type': 'paragraph', 'content': "Additionally, restricting access to the application to trusted users and monitoring for suspicious activity on the 'IDClient' parameter can help reduce risk until the upgrade is applied."}] [1]

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-59920. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart