Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-24707_AnukoTimeTracker_Version-1.20.0_POC | Kitploit
Tools/GitHubGitHub/thepiyushkumarshukla/cve-2022-24707_anukotimetracker_version-1.20.0_poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubthepiyushkumarshukla/cve-2022-24707_anukotimetracker_version-1.20.0_poc

CVE-2022-24707_AnukoTimeTracker_Version-1.20.0_POC

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
9 months agoNot yet reviewed

CVE-2022-24707 Anuko Time Tracker SQL Injection Exploit

A security assessment tool that demonstrates a SQL injection vulnerability in Anuko Time Tracker's Version 1.20.0 puncher feature. This tool helps to Dump the whole tt_users Database and revels every single entry, If used as per following the simple instructions !

⚠️ Disclaimer

This tool is intended for:

  • Security research and education
  • Authorized penetration testing
  • Vulnerability demonstration in controlled environments

Unauthorized use against systems you don't own or have explicit permission to test is illegal.

🚀 Features

  • Automated Exploitation: Streamlined process from login to credential extraction
  • SQL Injection: Exploits time-based SQL injection in puncher feature
  • Credential Extraction: Retrieves all user credentials from database
  • Automatic Cleanup: Removes traces after exploitation
  • User-Friendly Interface: Clear output and progress indicators
  • Error Handling: Robust error management and user feedback

📋 Prerequisites

WEB-APPLICATION ( Your must able to find all below settings, just explore the Web-Application )

  • Version 1.20.0 Or less
  • Administrator Access is MUST Required
  • Users database name is tt_users ( which is default OR also can be changed in script )
  • Creat a group in Anuko Time Tracker, Via Login as ADMINISTRATOR
  • Now Re-Login as Group Manager in Anuko web-app
  • Now add a DEMO project as group manager in the group
  • Now ENABLE the Puncher plugin from the Plugin section
  • MAKE SURE TO SAVE ALL THE CHANGES !

INTERNAL

  • Python 3.6+
  • Required packages:
    root@kitploit:~
    pip install requests beautifulsoup4 lxml

📖 Usage

python3 anuko_exploit.py --host http://target.com --username user --password pass

Example

python3 anuko_exploit.py --host http://192.168.1.100/timetracker --username admin --password admin123

Arguments

Argument Description Required

--host Target URL (e.g., http://target.com/timetracker) Yes --username Valid username for authentication Yes --password Valid password for authentication Yes --help Show help message and usage examples No

Download Tool