CVE-2024-9574 SQL Injection vulnerability in SOPlanning

What is CVE-2024-9574?

CVE-2024-9574 is a critical SQL injection vulnerability in SOPlanning, published on 7 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB.

Weakness: CWE-89

Which versions are affected by CVE-2024-9574?

It affects 1 product.

Products include Soplanning Soplanning.

How do I fix CVE-2024-9574?

No fix has been published for CVE-2024-9574 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-9574 being exploited?

There is no known exploitation of CVE-2024-9574 in the wild and no public exploit code.

Other vulnerabilities in SOPlanning

• CVE-2024-27115 Remote Code Execution through File Upload in SOPlanning before 1.52.02 Critical 10.0
• CVE-2024-57169 File upload in n/a Critical 9.8
• CVE-2020-13963 Hardcoded credentials in n/a Critical 9.8
• CVE-2014-8673 SQL injection in n/a Critical 9.8
• CVE-2024-27112 SQL Injection in SOPlanning before 1.52.02 Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5mch-6pwv-9qcv.