CVE-2026-9209 Details
Description
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
A vulnerability allowing unauthenticated SQL injection has been identified in mJobTime versions through 15.7.3.32. This issue resides in the Login.aspx admin panel, where certain handlers execute user-supplied SQL against the Sybase SQL Anywhere database. The vulnerability is exacerbated by the fact that these SQL executions are performed with DBA/sysadmin privileges, and there is no server-side authentication, relying instead on a client-side sessionStorage flag. Exploitation of this vulnerability allows attackers to execute arbitrary SQL, including commands that invoke xp_cmdshell and xp_read_file, leading to pre-authentication remote code execution as LocalSystem with just a single HTTP request.
No effective vendor fix is currently available. Until a corrected build is confirmed, organizations can restrict network access to the mJobTime web tier, disable or remove the vulnerable handlers at the IIS level, and reconfigure the database connection to use a least-privileged account instead of a sysadmin login.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://mjobtime.com/ | [email protected] | ProductVendor |
| https://www.sprocketsecurity.com/blog/cve-2026-9209-pre-authentication-sql-injection-to-remote-code-execution-in-mjobtime | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/mjobtime-unauthenticated-sql-execution-rce-via-login-aspx | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-250 | Execution with Unnecessary Privileges | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mJobTime | <= 15.7.3.32 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |