Attacker Value
Low
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
None
Privileges Required
High
Attack Vector
Network
0

CVE-2020-9269

Disclosure Date: February 18, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php.

Add Assessment

2
Ratings
  • Attacker Value
    Low
  • Exploitability
    Very High
Technical Analysis

This is an injection that is trivial to exploit and also to find.

https://github.com/J3rryBl4nks/SOPlanning

You can see the POC in my github. The exploit does require authentication, but you can extract the admin hash through the other SQL injection vulnerability or through the CSRF to add an admin user.

Due to the low volume of installs, this isn’t incredibly useful in the wild.

CVSS V3 Severity and Metrics
Base Score:
7.2 High
Impact Score:
5.9
Exploitability Score:
1.2
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
High
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • soplanning

Products

  • soplanning 1.45

Additional Info

Technical Analysis