CVE-2021-47966

HIGH

PHP Timeclock 1.04 SQL Injection via login.php

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-47966 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.

Description

PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that allows unauthenticated attackers to extract database contents. Attackers can submit crafted POST requests with SQL payloads using SLEEP functions or RLIKE conditional statements to dump sensitive database information including employee names and credentials.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 15, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

PHP Timeclock

Browse Timeclock / PHP Timeclock
CVE List1.04affected

Proofs of concept

1

Catalogued exploits

ExploitDBPHP Timeclock 1.04 - Time and Boolean Based Blind SQL InjectionExploitDB exploitby Tyler ButlerNot analyzed1 file
ExploitDB
PoC details

References

5