CVE-2025-9977 Times Software E-Payroll DoS and injection
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unsanitized POST parameter in Times Software E-Payroll enables unauthenticated DoS, SQL injection, and information disclosure.
CERT Polska disclosed CVE-2025-9977, an authentication bypass vulnerability in Times Software E-Payroll affecting the login process. An unauthenticated attacker can exploit an unsanitized POST parameter to conduct denial-of-service attacks against the application. The same parameter may be vulnerable to SQL injection, though backend filtering has so far prevented successful exploitation. Additionally, malformed inputs trigger verbose error messages that leak sensitive information about the application's internal infrastructure.
The vulnerability allows pre-authentication attack vectors, making it accessible to any network-connected user without credentials. No patching timeline is available; the vendor has not responded to disclosure coordination attempts by CERT Polska as the CNA. Organizations running Times Software E-Payroll should monitor for active exploitation attempts and implement network-level controls to rate-limit or block suspicious POST requests to the login endpoint.
Mentioned in this report
Detection guidance
Repeated Server Errors on POST to Login Endpoint
Detects POST requests to login-style endpoints that return HTTP 5xx, consistent with malformed-parameter DoS or error-leak probing like CVE-2025-9977. Alert on bursts per source IP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Server Errors on POST to Login Endpoint
description: Detects POST requests to login-style URIs that produce HTTP 5xx responses.
Malformed input to an unsanitized login POST parameter (as in CVE-2025-9977 Times
Software E-Payroll) causes crashes or verbose error pages. A single hit is weak;
alert on bursts from the same c-ip over a short window (threshold applied in the
SIEM).
tags:
- attack.impact
- attack.t1499.004
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- login
- logon
- signin
- authenticate
sc-status:
- 500
- 502
- 503
- 504
condition: selection
falsepositives:
- Application bugs or backend outages causing legitimate logins to fail with 5xx
- Load balancer health checks or monitoring that POST to the login URL
level: low
id: 9e863663-42c2-5643-a636-5c902bcb9cee
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2025/11/CVE-2025-9977
SQL Injection Patterns Against Login Endpoint
Detects common SQL injection payload strings in the query string of requests to login-style endpoints, as attempted against the E-Payroll login parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Patterns Against Login Endpoint
description: Detects typical SQL injection payload fragments in requests to login-style
URIs. The CVE-2025-9977 report notes the vulnerable login parameter may be injectable.
This only covers payloads visible in the URI query string, not POST bodies.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|contains:
- login
- logon
- signin
- authenticate
selection_sqli:
cs-uri-query|contains:
- union select
- union%20select
- union+select
- ''' or '
- '%27%20or%20'
- or 1=1
- or%201=1
- waitfor delay
- waitfor%20delay
- sleep(
- benchmark(
- information_schema
condition: selection_uri and selection_sqli
falsepositives:
- Authorised vulnerability scanners or penetration tests against the application
- Web application firewall testing tools
level: medium
id: bcf918dd-7c5c-5ccf-aec3-91f3903ac0aa
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2025/11/CVE-2025-9977
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/11/CVE-2025-9977
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs