mJobTime Build 15.7.3.32 Exposes LocalSystem RCE via Broken Login Handlers
Unauthenticated attackers can execute arbitrary SQL on Sybase backends, achieving remote code execution as LocalSystem through exposed admin endpoints.
Key points
- CVE-2026-9209 is rated CVSS 9.3 Critical due to full remote code execution.
- The flaw affects mJobTime builds up to and including 15.7.3.32.
- Authentication relies solely on a client-side flag, allowing bypass.
mJobTime, the workforce management software, contains a critical vulnerability that allows unauthenticated remote code execution. The issue stems from inadequate authentication in its web-based admin handlers, enabling attackers to execute arbitrary commands on the host server.
How does the vulnerability work?
The flaw resides in the Login.aspx admin panel handlers. Specifically, the `runQueryButton` postback and the `exportSqlQuery_Server` PageMethod process user-supplied SQL queries. These endpoints execute the submitted SQL against the backing Sybase SQL Anywhere database. Crucially, they do so using DBA or sysadmin privileges. The application fails to enforce server-side authentication for these actions. Instead, it relies on a client-side `sessionStorage` flag, which an attacker can easily bypass or ignore.
What is the impact of exploitation?
Because the SQL execution occurs with high-privilege database accounts, attackers can invoke extended stored procedures such as `xp_cmdshell` and `xp_read_file`. This capability allows for pre-authentication remote code execution. The resulting code runs with LocalSystem privileges on the host machine. An attacker can achieve this full compromise via a single HTTP request, without needing valid credentials or prior access to the application.
Which versions are affected?
The vulnerability impacts mJobTime software up to build 15.7.3.32. The National Vulnerability Database lists this specific build limit. Any deployment running this version or earlier is considered vulnerable. The weaknesses are classified under CWE-306 (Authentication Bypass) and CWE-250 (Execution with Unnecessary Privileges).
Is there a fix available?
The source material does not confirm the availability of a patch or updated build. Security operations teams should assume no fix has been released yet. Immediate mitigation requires blocking access to the affected endpoints or applying network-level restrictions to prevent unauthenticated requests to the Login.aspx handlers.
What to do and how to stay safe: mJobTime
- Scanners detect known signatures and misconfigurations but miss logic flaws and context-dependent vulnerabilities.
- False positives increase with scan frequency, creating alert fatigue that distracts from genuine threats.
- Scanning is worth it for compliance and asset inventory, but not for replacing penetration testing or code review.
Vulnerability scanning identifies known weaknesses but cannot find logic flaws or novel exploits. Combine automated scanning with manual testing and secure coding practices to achieve comprehensive security coverage.
Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What CVE ID corresponds to the mJobTime SQL injection flaw?
The vulnerability is tracked as CVE-2026-9209.
Can this flaw be exploited remotely without authentication?
Yes, it allows pre-authentication remote code execution via a single HTTP request.
What privileges does the attacker gain?
The attacker gains LocalSystem privileges on the host server.
