CVE-2024-9573

Description

SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on the server.

Reserved 2024-10-07 | Published 2024-10-07 | Updated 2024-10-07 | Assigner INCIBE

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

Any version before 1.45
affected

Credits

Rafael Pedrero finder

References

www.incibe.es/...s/aviso/multiple-vulnerabilities-soplanning

cve.org (CVE-2024-9573)

nvd.nist.gov (CVE-2024-9573)

Download JSON