CVE-2013-10033: Kimai 0.9.2 db_restore.php SQL Injection

Published Jul 31, 2025

Updated

An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the dbrestore.php endpoint. The flaw allows attackers to inject arbitrary SQL queries into the dates[] POST parameter, enabling file write via INTO OUTFILE under specific environmental conditions. This can lead to remote code execution by writing a PHP payload to the web-accessible temporary directory. The vulnerability has been confirmed in versions including 0.9.2.beta, 0.9.2.1294.beta, and 0.9.2.1306-3.

Affected Software

1 affected component

Kimai Kimai>=0.9.2

Event History

Jul 31, 2025

CVE Published

via MITRE·02:56 PM

Data Sourced

via MITRE·02:56 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2013-10033?

CVE-2013-10033 is classified as a high severity vulnerability due to the potential for remote code execution via SQL injection.

How do I fix CVE-2013-10033?

To fix CVE-2013-10033, upgrade to a version of Kimai that is patched for this vulnerability, specifically a version later than 0.9.2.

What systems are affected by CVE-2013-10033?

CVE-2013-10033 affects Kimai versions 0.9.2 and earlier.

What type of vulnerability is CVE-2013-10033?

CVE-2013-10033 is an unauthenticated SQL injection vulnerability.

What can attackers do with CVE-2013-10033?

Attackers exploiting CVE-2013-10033 can inject arbitrary SQL queries, potentially leading to data manipulation or unauthorized file writes.