The active attacks targeting construction companies that exploit a critical SQL injection vulnerability in Mjobtime, a popular labor time-tracking application.
The vulnerability, tracked as CVE-2025-51683, allows threat actors to execute arbitrary commands on backend Microsoft SQL Server instances through the application’s Internet Information Services (IIS) web interface.
The vulnerability highlights a persistent challenge in enterprise security: the “hidden attack surface” created when business applications silently install supporting infrastructure.
Just as researchers at Huntress discovered in late 2024 with FOUNDATION accounting software, Mjobtime’s installation includes an MSSQL database backend that many organizations may not realize requires separate security hardening.
Mjobtime markets itself as all-in-one construction software for labor time tracking, equipment tracking, and reporting. The web-based application runs on Microsoft IIS and uses MSSQL as its database backend.
Security researcher Dario Wiess from InfoGuard Labs discovered a blind SQL injection vulnerability in version 15.7.2 that enables remote code execution. The vulnerability received a CVSS severity score of 9.8, indicating critical risk.
According to Huntress analysts, attackers have been actively exploiting this vulnerability since February 21, 2025 one day before Wiess first contacted the vendor.
Additional incidents occurred on December 2, December 11, and December 20, 2025, demonstrating sustained interest from threat actors targeting the construction sector.
Technical Attack Chain
The attack begins with a specially crafted POST request to the endpoint /Default.aspx/update_profile_Server.
This query triggers the SQL injection vulnerability, allowing attackers to interact directly with the underlying database.
Once initial access is established, threat actors enable the xp_cmdshell extended stored procedure, which provides a command shell interface through SQL commands.
Evidence from compromised systems shows the procedure activation appears in Application Event Logs as:Â MSSQL$MJOBTIME/15457;xp_cmdshell,0,1.
With this capability enabled, attackers can execute Windows commands with the privileges of the database service account, typically running as SYSTEM.
Huntress documented the specific commands executed during intrusions. In the first observed incident, the threat actor ran cmd /c net user to enumerate local accounts before attempting to ping an external domain: ei0lwafp0h7178z7qer9r9oualgc45su.oastify.com.
In subsequent attacks against two other customers, attackers used wget and curl commands to interact with the same external resource.
Notably, the campaigns appeared limited in scope researchers observed no attempts to deploy additional malware, exfiltrate data, or establish persistence mechanisms beyond the initial SQL injection vector. The attacks ceased after the discovery and isolation of affected hosts.
The threat becomes more severe based on deployment architecture. Huntress found that in two of the three incidents, the IIS web server and MSSQL database server ran on the same endpoint, maximizing the impact of a successful compromise.
In the third case, separate servers were used, though the SQL injection still granted significant access to the database tier.
Organizations face a critical obstacle: Mjobtime has not released a security patch. Searches of the company’s website reveal no security advisories or press releases acknowledging the vulnerability.
The absence of official remediation guidance forces security teams to implement compensating controls rather than applying a direct fix.
Mitigations
Until a patch becomes available, security teams should:
- Restrict network access to Mjobtime installations using IP allowlisting.
- Implement Web Application Firewall (WAF) rules to block POST requests.to /Default.aspx/update_profile_Server.
- Disable xp_cmdshell on MSSQL instances if not required for business operations.
- Separate IIS and MSSQL servers onto different endpoints with strict network segmentation.
- Monitor IIS logs for repeated POST requests to the vulnerable endpoint.
- Review Application Event Logs for xp_cmdshell enablement events.
The Mjobtime campaign underscores a fundamental security principle: every component of an application stack represents potential attack surface.
Construction firms, already prime targets for ransomware groups, must inventory all installed software and their dependencies to prevent silent infrastructure from becoming silent entry points for attackers.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
