How Hacked Construction Apps Are Bringing Down Jobsite Security

What it is

Detection and hunting detail for CVE-2025-51683, a blind SQL injection in Mjobtime construction labor-tracking software (v15.7.2, web-based on IIS with an MSSQL backend). Huntress SOC observed active exploitation across three customer incidents in 2025 (first on Feb 21, then Dec 2, Dec 11, and Dec 20). The summary names the CVE and endpoint; what follows are the specific log artifacts an engineer would use to hunt for it, plus a deployment nuance that affects where to look.

Preconditions / Affected

Mjobtime v15.7.2 exposed on IIS with an MSSQL backend. Notably, the web server and MSSQL instance are not always co-located: in two of the three incidents they were on the same endpoint, but in one they were on different endpoints. That matters for hunting — the IIS log evidence and the MSSQL execution evidence may live on separate hosts.

What to do

Hunt for the initial access vector in IIS web server logs. Exploitation showed multiple entries of:

POST /Default.aspx/update_profile_Server

Then check the MSSQL host's Application Event Log for xp_cmdshell being enabled. On one customer this appeared as:

MSSQL$MJOBTIME/15457;xp_cmdshell,0,1

Look for post-exploitation OOB/recon commands run via the MSSQL service. In the first incident, before host isolation, the actor ran:

cmd /c net user
ping ei0lwafp0h7178z7qer9r9oualgc45su.oastify.com

The other two incidents used wget and curl against the same oastify.com (Burp Collaborator) resource. Any callback to an oastify.com domain from the database host is a strong signal. No patch exists per the writeup — contact the vendor directly for remediation.

flowchart LR
  A[POST Default.aspx/<br/>update_profile_Server<br/>in IIS logs] --> B{Same host or split?}
  B -->|Same endpoint| C[MSSQL Event Log:<br/>xp_cmdshell enabled]
  B -->|Different endpoint| C
  C --> D[OOB recon: net user,<br/>ping/wget/curl to oastify.com]

Caveats

• The behavior seen was limited: after the OOB commands, Huntress observed no further activity — no additional native utilities, no follow-on code execution, no installation. Treat the callbacks as reconnaissance/validation, not confirmed deeper compromise.
• The Feb 21, 2025 incident predates the researcher's first vendor contact (Feb 20) and the InfoGuard advisory (late Nov 2025), suggesting exploitation in the wild ahead of public disclosure.
• The CVSS 98 figure the page cites is AI-generated search-engine output, not a vendor or NVD score — do not treat it as authoritative (a valid CVSS base score cannot exceed 10).