Blind SQL Injection in PHP Timeclock Login Parameter

PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that allows unauthenticated attackers to extract database contents. Attackers can submit crafted POST requests with SQL payloads using SLEEP functions or RLIKE conditional statements to dump sensitive database information including employee names and credentials.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

PHP Timeclock 1.04 is vulnerable to time-based and boolean-based blind SQL injection attacks through the login_userid parameter in login.php. This vulnerability (CVE-2021-47966, CVSS 8.2) allows unauthenticated attackers to extract sensitive database contents by submitting crafted POST requests with SQL payloads. Attackers leverage SLEEP functions and RLIKE conditional statements to infer database structure and dump employee names and credentials without requiring valid authentication. Organizations using this timeclock application—particularly small to medium-sized businesses relying on PHP-based HR systems—face immediate risk of credential theft, unauthorized access escalation, and potential lateral movement throughout their infrastructure.

Casky's 301 matched skills detect the attack patterns associated with this vulnerability by analyzing reconnaissance and exploitation techniques mapped to MITRE ATT&CK (TA0001 - Initial Access and TA0043 - Reconnaissance). Claude's extended reasoning capabilities identify time-delay anomalies in login requests, suspicious SQL syntax patterns in POST parameters, and sequential queries indicating database enumeration attempts. Practitioners reviewing their findings would observe flagged login.php requests containing SLEEP() clauses, conditional RLIKE statements, or unusual response timing correlations—all hallmarks of blind SQL injection probing. The skills also cross-reference credential access patterns (T1110 - Brute Force variations) when database dumping techniques successfully extract password hashes, enabling security teams to correlate injection attacks with downstream authentication abuse and implement compensating controls immediately.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2021-47966.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2021-47966

Casky has 301 skills that investigate the attack patterns behind CVE-2021-47966. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn