How Hacked Construction Apps Are Bringing Down Jobsite Security

Huntress analysts observed multiple real-world intrusions exploiting a blind SQL injection (CVE-2025-51683) in the Mjobtime web application that enabled xp_cmdshell on MSSQL and allowed remote command execution (examples: net user, DNS exfiltration via ping, wget/curl downloads). Three separate customer incidents in 2025 were linked to the vulnerability; activity appeared limited to executing initial commands before detection and containment. Organizations running Mjobtime should contact the vendor and secure their IIS/MSSQL installations, monitor for the shown IIS POST pattern and xp_cmdshell enablement, and apply mitigations promptly.