CVE-2020-9269

SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php.

Recent assessments:

J3rryBl4nks at March 09, 2020 9:09pm UTC reported:

This is an injection that is trivial to exploit and also to find.

<https://github.com/J3rryBl4nks/SOPlanning&gt;

You can see the POC in my github. The exploit does require authentication, but you can extract the admin hash through the other SQL injection vulnerability or through the CSRF to add an admin user.

Due to the low volume of installs, this isn’t incredibly useful in the wild.

Assessed Attacker Value: 2
Assessed Attacker Value: 2Assessed Attacker Value: 5