CyberRota Analysis
AI-GeneratedDayforce Payroll is susceptible to a Time-Based Blind SQL Injection in its password recovery feature, allowing unauthenticated attackers to execute arbitrary SQL queries via specially crafted GET requests. This critical vulnerability poses a significant risk of data exposure and manipulation, making it imperative for organizations using this software, particularly those on version R2026.2.0, to prioritize immediate remediation efforts. All users of Dayforce Payroll should assess their systems for potential impact and apply necessary security measures.
Original NVD Description
Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version R2026.2.0 but may also affect other versions.