mJobTime EUVD-2026-95035

No special conditions - remote unauthenticated exploitation against default configurations of mJobTime through build 15.7.3.32, because the runQueryButton postback and exportSqlQuery_Server PageMethod execute attacker-supplied SQL with no server-side authentication beyond a client-side sessionStorage flag that provides no real protection. The practical prerequisites that limit exploitation are: the Login.aspx handlers must be network-reachable, the backing Sybase SQL Anywhere database must expose the xp_cmdshell and xp_read_file extended procedures (available by default under the DBA/sysadmin context the app uses), and the target must be running an affected build (<= 15.7.3.32). No user interaction, credentials, or non-default configuration is required.

All available signals point to genuine high priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) indicates a network-reachable, low-complexity, unauthenticated attack with total compromise of confidentiality, integrity, and availability - consistent with the description's claim of pre-authentication RCE as LocalSystem via a single HTTP request. The PR:N rating is well-supported because authentication is enforced only by a client-side sessionStorage flag that is trivially bypassed, not by any server-side check. CWE-250 (execution with unnecessary privileges) aligns with the SQL running under DBA/sysadmin, enabling xp_cmdshell. No EPSS score is provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV in the input, and no explicit POC flag is present, so there is no confirmed active exploitation; however, a dedicated Sprocket Security research blog and a VulnCheck advisory both publicly document the full SQL-injection-to-RCE path, which materially lowers the barrier to weaponization. The main factor tempering real-world risk is product footprint: mJobTime is niche, industry-specific workforce/time-tracking software rather than ubiquitous infrastructure, so this is a serious issue for the organizations that run it but not a mass-internet event on the scale of a core-library flaw.

An unauthenticated attacker locates an internet- or network-reachable mJobTime Login.aspx panel and sends a single crafted HTTP POST invoking the runQueryButton postback or the exportSqlQuery_Server PageMethod, embedding SQL that calls xp_cmdshell to run operating-system commands as LocalSystem on the host. Because server-side authentication is absent (only a client-side sessionStorage flag gates access), no credentials or user interaction are needed, matching the AV:N/AC:L/PR:N/UI:N vector. No public exploit is flagged in the input, but the Sprocket Security and VulnCheck writeups document the exact exploitation technique.