CVE-2026-9209: mJobTime Unauthenticated SQL Execution via Login.aspx
mJobTime through build 15.7.3.32 is affected by an unauthenticated SQL execution flaw in the Login.aspx admin panel handlers, classified under CWE-250. According to the record, a single crafted HTTP request could lead to remote code execution as LocalSystem. No fixed version is listed in the sources consulted, and no confirmed exploitation appears in them.
Overview
The record describes an unauthenticated SQL execution issue in mJobTime through build 15.7.3.32, reachable through the Login.aspx admin panel handlers. The weakness is classified as CWE-250, execution with unnecessary privileges, because the description states that the backing database is accessed with DBA/sysadmin rights.
Impact
- The record states the flaw can lead to pre-authentication remote code execution as LocalSystem.
- The CVSS base score of 9.8 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network reachability, no privileges required, and high impact on confidentiality, integrity and availability.
- A CVSS score of 9.3 from VulnCheck is also recorded.
Affected products and versions
- Product: mJob mJobTime.
- Affected range: through build 15.7.3.32 (the record gives this as up to and including 15.7.3.32).
- No fixed version is listed in the record. This is unknown and does not mean that no fix exists.
Exploitation status
- The CISA KEV catalog flag is false, so this record does not confirm exploitation in the wild.
- The SSVC exploitation field is recorded as poc (proof of concept), and the SSVC automatable field is yes.
- The EPSS probability is 0.00691 with a percentile of 0.52286, dated 2026-10-23.
- No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Identify all mJobTime installations and confirm whether they are at or below build 15.7.3.32.
- Check the mJobTime product page and the VulnCheck advisory for vendor updates, since no fixed build is named in the record.
- Restrict network access to the admin panel and its handlers to trusted management networks until a vendor fix is verified.
- Review the database service account privileges and reduce them where the application allows, in line with the weakness described by CWE-250.
- Consider isolating affected hosts until remediation is confirmed.
Detection guidance
- Review web server logs for unexpected requests to Login.aspx and related page method calls from untrusted sources.
- Monitor application hosts for unexpected child processes or new services started under the mJobTime service account.
- Review database audit logs for administrative or system-level operations that do not match normal application behavior.
Limitations of the available information
- The record does not list a fixed version, vendor patch or patch date.
- The record shows the source status as Deferred.
- Technical details beyond the record's description are not reproduced here, and this analysis does not describe exploitation steps.
- The affected range comes from the record and has not been independently checked against the vendor release history.
Frequently asked questions
Which mJobTime versions are affected by CVE-2026-9209?
The record lists mJobTime through build 15.7.3.32 as affected. No fixed build is named in the sources consulted, so administrators should confirm their build and check the vendor for updates.
Is this vulnerability being exploited in the wild?
The CISA KEV flag is false in this record, so it does not confirm active exploitation. The SSVC exploitation field is poc, and no confirmed exploitation appears in the sources consulted.
What can administrators do before a fix is available?
Restrict network access to the admin panel to trusted networks, reduce database service account privileges where possible, and monitor logs and hosts for unexpected activity.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.