CVE-2014-8677
published 2017-08-31CVE-2014-8677: The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a…
PriorityP342medium5.3CVSS 3.0
AVNACHPRLUINSUCNIHAN
EXPLOIT
EPSS
3.49%
87.7th percentile
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not writable to execute arbitrary php code via a crafted database name.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| soplanning | soplanning | <= 1.32 | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.htmlhttp://seclists.org/fulldisclosure/2015/Jul/44http://www.securityfocus.com/bid/75726https://www.exploit-db.com/exploits/37604/http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.htmlhttp://seclists.org/fulldisclosure/2015/Jul/44http://www.securityfocus.com/bid/75726https://www.exploit-db.com/exploits/37604/
2017-08-31
Published