CVE-2025-9977

Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been prevented probably by backend filtering mechanisms. Additionally, command injection attempts cause the application to return extensive error messages disclosing some information about the internal infrastructure. Patching status is unknown because the vendor has not replied to messages sent by the CNA.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2025/11/CVE-2025-9977
https://www.timesoftsg.com.sg/payroll-software/

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El valor proporcionado en uno de los parámetros POST enviado durante el proceso de inicio de sesión en Times Software E-Payroll no se depura correctamente, lo que permite a un atacante no autenticado realizar ataques DoS. Los ataques de inyección SQL también podrían ser factibles, aunque hasta ahora la creación de un exploit funcional se ha evitado probablemente por mecanismos de filtrado de backend. Además, los intentos de inyección de comandos hacen que la aplicación devuelva mensajes de error extensos que revelan información sobre la infraestructura interna. El estado de los parches es desconocido porque el proveedor no ha respondido a los mensajes enviados por la CNA.

Information

Published : 2025-11-18 16:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-9977

Mitre link : CVE-2025-9977

CVE.ORG link : CVE-2025-9977

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2025-9977", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9977", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T20:43:24.527025Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Times Software", "product": "E-Payroll", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "20250121.0"}], "defaultStatus": "unknown"}]}], "published": "2025-11-18T16:15:47.027", "references": [{"url": "https://cert.pl/en/posts/2025/11/CVE-2025-9977", "source": "cvd@cert.pl"}, {"url": "https://www.timesoftsg.com.sg/payroll-software/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been prevented probably by backend filtering mechanisms.\nAdditionally, command injection attempts cause the application to return extensive error messages disclosing some information about the internal infrastructure.\u00a0\nPatching status is unknown because the vendor has not replied to messages sent by the CNA."}, {"lang": "es", "value": "El valor proporcionado en uno de los par\u00e1metros POST enviado durante el proceso de inicio de sesi\u00f3n en Times Software E-Payroll no se depura correctamente, lo que permite a un atacante no autenticado realizar ataques DoS. Los ataques de inyecci\u00f3n SQL tambi\u00e9n podr\u00edan ser factibles, aunque hasta ahora la creaci\u00f3n de un exploit funcional se ha evitado probablemente por mecanismos de filtrado de backend.\nAdem\u00e1s, los intentos de inyecci\u00f3n de comandos hacen que la aplicaci\u00f3n devuelva mensajes de error extensos que revelan informaci\u00f3n sobre la infraestructura interna.\nEl estado de los parches es desconocido porque el proveedor no ha respondido a los mensajes enviados por la CNA."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "cvd@cert.pl"}