CVE-2024-27112

SQL Injection in SOPlanning before 1.52.02

CVE CVE-2024-27112
Title SQL Injection in SOPlanning before 1.52.02
Credits
Affected products
Product Affected Unaffected Unknown
Simple Online Planning SO Planning = before 1.52.01 ()
everything else
CVSS
Base score 9.3 - CRITICAL
Attack Vector NETWORK
Attack Complexity> LOW
Attack Requirements NONE
Privileges Required NONE
Confidentiality Impact
Vulnerable system HIGH Subsequent systems NONE
Integrity Impact
Vulnerable system HIGH Subsequent systems NONE
Availability Impact
Vulnerable system HIGH Subsequent systems NONE
Safety impact NEGLIGIBLE
Automatable YES
Recovery USER
Value Density CONCENTRATED
Vulnerability Response effort MODERATE
Provider Urgency RED
References https://csirt.divd.nl/CVE-2024-27112 ( third-party-advisory )
Problem type(s) CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact(s) CAPEC-66 SQL Injection
Configuration(s) The public view setting must be enabled.
Date published
Last modified 11 Sep 2024 13:58 UTC

Description

A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database. The vulnerability has been remediated in version 1.52.02. 

Workaround(s)

Disable the public view setting.

JSON version.