1 HTTP Request: mJobTime SQLi Bypasses Auth to Run Code as LocalSystem in Builds to 15.7.3.32

A severe security flaw in the mJobTime workforce management application allows attackers to take complete control of affected servers. The vulnerability, tracked as CVE-2026-9209, carries a CVSS score of 9.3, classified as critical. It enables unauthenticated remote code execution, meaning an attacker does not need to steal or guess a password to compromise the system.

The risk

The vulnerability exists in the Login.aspx admin panel handlers within mJobTime. Specifically, the `runQueryButton` postback and the `exportSqlQuery_Server` PageMethod fail to properly validate user input. According to the National Vulnerability Database, these endpoints execute caller-supplied SQL directly against the backing Sybase SQL Anywhere database.

The application runs these queries with DBA or sysadmin privileges. This high level of access allows an attacker to invoke system stored procedures such as `xp_cmdshell` and `xp_read_file`. By submitting a single HTTP request containing malicious SQL, an attacker can execute arbitrary commands on the host machine. The resulting code execution runs with LocalSystem privileges, granting the attacker full control over the server.

The application’s security model relies on a client-side `sessionStorage` flag for authentication. This check is not enforced on the server side. Consequently, an attacker can bypass the login screen entirely by targeting the vulnerable endpoints directly. The combination of unauthenticated access, high-privilege database execution, and the ability to run system commands makes this a high-severity threat.

Who is exposed

The flaw affects all versions of mJobTime up to and including build 15.7.3.32. Any organization using these versions with the admin panel exposed to a network accessible by attackers is at risk. Because the exploit requires no authentication, it can be launched from outside the corporate network if the service is internet-facing.

Cost and compliance

The source material does not provide information regarding financial costs, regulatory penalties, or compliance implications associated with this vulnerability.

What should you do?

Organizations should immediately verify if they are running mJobTime build 15.7.3.32 or earlier. If the application is exposed to untrusted networks, administrators should restrict access to the admin panel endpoints until a patch is available.

Background: Unauthenticated remote code execution

Unauthenticated remote code execution allows an attacker to run commands on a server without login credentials. The process begins with network access, moves to input manipulation, triggers a software flaw, and ends with arbitrary command execution. Defenses require strict input validation, minimal service exposure, and runtime protection mechanisms that isolate memory and restrict system calls.

Read the full guide: Unauthenticated Remote Code Execution: How the Attack Works

What to do and how to stay safe: mJobTime

• Audit your network to identify any instances of mJobTime running versions up to 15.7.3.32.
• Restrict network access to the mJobTime admin panel, ensuring it is not reachable from untrusted networks or the public internet.
• Monitor server logs for unusual HTTP requests targeting the Login.aspx handlers or unexpected SQL execution patterns.
• Wait for the vendor to release an official update and apply it as soon as it becomes available.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-9209?

It is a critical SQL injection vulnerability in mJobTime that allows unauthenticated remote code execution.

Which versions of mJobTime are affected?

All builds up to and including 15.7.3.32 are affected by this vulnerability.

Does an attacker need a password to exploit this?

No, the vulnerability allows for unauthenticated access, so no valid credentials are required.