by Kastro
Paper/Archive/CVE-2024-27112

CVE-2024-27112

Simple Online Planning SO Planning — SQL Injection in SOPlanning before 1.52.02

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.5.355 × 207.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database. The vulnerability has been remediated in version 1.52.02.

Affected

ProductAffectedFixed inSource
SO Planningbefore 1.52.01–CNA
soplanning< 1.52.021.52.02CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
DIVD (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Red
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcsirt.divd.nl/CVE-2024-27112