# CVE-2025-9977 Times Software E-Payroll DoS and injection

Published: 2025-11-18 · Severity: routine · Sectors: financial-services
Canonical: https://vorant.io/reports/59e6ec69-11c6-5186-959a-48466228373f/cve-2025-9977-times-software-e-payroll-dos-and-injection

> Unsanitized POST parameter in Times Software E-Payroll enables unauthenticated DoS, SQL injection, and information disclosure.

CERT Polska disclosed CVE-2025-9977, an authentication bypass vulnerability in Times Software E-Payroll affecting the login process. An unauthenticated attacker can exploit an unsanitized POST parameter to conduct denial-of-service attacks against the application. The same parameter may be vulnerable to SQL injection, though backend filtering has so far prevented successful exploitation. Additionally, malformed inputs trigger verbose error messages that leak sensitive information about the application's internal infrastructure.

The vulnerability allows pre-authentication attack vectors, making it accessible to any network-connected user without credentials. No patching timeline is available; the vendor has not responded to disclosure coordination attempts by CERT Polska as the CNA. Organizations running Times Software E-Payroll should monitor for active exploitation attempts and implement network-level controls to rate-limit or block suspicious POST requests to the login endpoint.

## Mentioned in this report

- Vulnerabilities: CVE-2025-9977

## Detection guidance (public sample)

### Repeated Server Errors on POST to Login Endpoint

ATT&CK: T1499.004

Detects POST requests to login-style endpoints that return HTTP 5xx, consistent with malformed-parameter DoS or error-leak probing like CVE-2025-9977. Alert on bursts per source IP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Repeated Server Errors on POST to Login Endpoint
description: Detects POST requests to login-style URIs that produce HTTP 5xx responses.
  Malformed input to an unsanitized login POST parameter (as in CVE-2025-9977 Times
  Software E-Payroll) causes crashes or verbose error pages. A single hit is weak;
  alert on bursts from the same c-ip over a short window (threshold applied in the
  SIEM).
tags:
- attack.impact
- attack.t1499.004
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
    - login
    - logon
    - signin
    - authenticate
    sc-status:
    - 500
    - 502
    - 503
    - 504
  condition: selection
falsepositives:
- Application bugs or backend outages causing legitimate logins to fail with 5xx
- Load balancer health checks or monitoring that POST to the login URL
level: low
id: 9e863663-42c2-5643-a636-5c902bcb9cee
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2025/11/CVE-2025-9977
```

### SQL Injection Patterns Against Login Endpoint

ATT&CK: T1190

Detects common SQL injection payload strings in the query string of requests to login-style endpoints, as attempted against the E-Payroll login parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Patterns Against Login Endpoint
description: Detects typical SQL injection payload fragments in requests to login-style
  URIs. The CVE-2025-9977 report notes the vulnerable login parameter may be injectable.
  This only covers payloads visible in the URI query string, not POST bodies.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
    - login
    - logon
    - signin
    - authenticate
  selection_sqli:
    cs-uri-query|contains:
    - union select
    - union%20select
    - union+select
    - ''' or '
    - '%27%20or%20'
    - or 1=1
    - or%201=1
    - waitfor delay
    - waitfor%20delay
    - sleep(
    - benchmark(
    - information_schema
  condition: selection_uri and selection_sqli
falsepositives:
- Authorised vulnerability scanners or penetration tests against the application
- Web application firewall testing tools
level: medium
id: bcf918dd-7c5c-5ccf-aec3-91f3903ac0aa
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2025/11/CVE-2025-9977
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/11/CVE-2025-9977

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/59e6ec69-11c6-5186-959a-48466228373f/cve-2025-9977-times-software-e-payroll-dos-and-injection.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup