SOPlanning 1.45 - 'by' SQL Injection

Exploit Title: SOPlanning 1.45 - 'by' SQL Injection Date: 2020-02-14 Exploit Author: J3rryBl4nks Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/ Version 1.45 Tested on Windows 10/Kali Rolling The SOPlanning application i...

SOPlanning 1.45 - 'users' SQL Injection

Exploit Title: SOPlanning 1.45 - 'users' SQL Injection Date: 2020-02-14 Exploit Author: J3rryBl4nks, Homebrewer Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/ Version 1.45 Tested on Windows 10/Kali Rolling The SOPlannin...

SOPlanning 1.45 SQL Injection

Exploit Title: SOPlanning 1.45 - 'users' SQL Injection Date: 2020-02-14 Exploit Author: J3rryBl4nks, Homebrewer Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/ Version 1.45 Tested on Windows 10/Kali Rolling The SOPlannin...

SOPlanning 1.45 Cross Site Request Forgery

Exploit Title: SOPlanning 1.45 - Cross-Site Request Forgery Add User Date: 2020-02-14 Exploit Author: J3rryBl4nks Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/ Version 1.45 Tested on Windows 10/Kali Rolling The...

CVE-2019-20179

SOPlanning 1.45 has SQL injection via the userlist.php "by" parameter...

Sql injection

SOPlanning 1.45 has SQL injection via the userlist.php "by" parameter...

CVE-2019-20179

SOPlanning 1.45 has SQL injection via the userlist.php "by" parameter...

CVE-2019-20179

SOPlanning 1.45 is vulnerable to a SQL injection via the user_list.php parameter "by". The root cause is a lack of validation of externally entered SQL in a database-driven application. Documented impact is consistent with a high-severity risk (CVSS3.1: 8.8; CVSS2.0: 6.5) affecting confidentialit...

Cross site scripting

Multiple Cross-Site Scripting XSS vulnerabilities exist in Simple Online Planning SOPlanning before 1.33 via the document.cookie in nbmois and mbligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code...

CVE-2014-8674

SOPlanning (Simple Online Planning) is affected by multiple vulnerabilities in versions prior to 1.33. The CVE entries describe cross-site scripting via document.cookie in nb_mois and mb_ligness and through a debug GET parameter to export.php, enabling arbitrary code execution under XSS condition...

CVE-2014-8674

Multiple Cross-Site Scripting XSS vulnerabilities exist in Simple Online Planning SOPlanning before 1.33 via the document.cookie in nbmois and mbligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code...

SOPlanning Detection (HTTP)

HTTP based detection of SOPlanning. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.112034";...

SOPlanning < 1.33 Multiple Vulnerabilities

SOPlanning is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:soplanning:soplanning";...

CVE-2014-8677

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and...

Code injection

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and...

CVE-2014-8676

Directory traversal vulnerability in the filegetcontents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. dot dot in a URL path parameter...

Directory traversal

Directory traversal vulnerability in the filegetcontents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. dot dot in a URL path parameter...

CVE-2014-8675

Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash...

Default credentials

Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash...

CVE-2014-8675

CVE-2014-8675 affects Soplanning 1.32 and earlier. The issue arises from static ICAL calendar sharing links that embed login information, enabling an attacker to brute-force the embedded password hash and obtain a calendar owner’s password. Connected sources corroborate that SOPlanning