Cyberattackers Exploit SQL Injection Flaw in Mjobtime Construction Software Attackers are targeting construction firms by exploiting a critical vulnerability in Mjobtime, a time-tracking application widely used in the industry. The flaw, tracked as CVE-2025-51683, affects Mjobtime version 15.7.2 and enables blind SQL injection via the `/Default.aspx/update_profile_Server` endpoint. By sending crafted HTTP POST requests, threat actors can manipulate the application’s MSSQL database to execute system commands. The attack chain leverages the xp_cmdshell stored procedure, granting attackers remote command execution with the permissions of the service account often providing deep access to the Windows host. Security firm Huntress observed this pattern in three separate incidents in 2025, all tied to Mjobtime deployments in the construction sector. In one case, attackers used xp_cmdshell to run reconnaissance commands (`net user`) and test connectivity via oastify.com. In two other instances, they attempted to fetch remote payloads using wget and curl, though further intrusion was prevented. The vulnerability stems from improper input validation, allowing attackers to bypass security controls and turn the database into a remote shell behind the firewall. This not only exposes sensitive project and payroll data but also creates a foothold for lateral movement within the network. Indicators of compromise include repeated POST requests to the vulnerable endpoint and xp_cmdshell activation in MSSQL logs.