An authenticated SQL injection vulnerability in TimeClock Software 1.01 allows attackers to enumerate system usernames, posing a risk of unauthorized information disclosure.

The application is susceptible to a time-based SQL injection vulnerability within the add_entry.php script. An authenticated attacker can manipulate the notes parameter to inject time-delay commands, enabling the systematic enumeration of usernames through response time analysis.

Successful exploitation of this vulnerability allows an attacker to map the user directory of the application. While the CVSS score of 7.1 reflects the requirement for authentication, the ability to harvest valid usernames facilitates further targeted attacks, such as credential stuffing or brute-force attempts against the administrative interface, potentially leading to full system compromise.

Immediate Action: As no official patch is currently available, administrators should restrict access to the add_entry.php endpoint to trusted internal networks only.

Proactive Monitoring: Review application access logs for unusual patterns in POST requests to add_entry.php, specifically monitoring for high-frequency requests containing SQL keywords or unexpected time delays.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious SQL injection payloads targeting the notes parameter.

Public Exploit Available: Yes, a proof-of-concept Python script is available on Exploit-DB (EDB-ID 48874).

Due to the availability of a functional proof-of-concept, the risk to organizations running TimeClock Software 1.01 is elevated. Administrators must treat this as a high-priority item and implement strict network-level access controls or WAF filtering immediately to prevent unauthorized username enumeration. Until a vendor-supplied patch is released, assume the application is at risk of reconnaissance activities.