CVE-2014-8677 | BDVDB-2026-89818 Detail

Description#

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not writable to execute arbitrary php code via a crafted database name.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/75726
http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html
http://seclists.org/fulldisclosure/2015/Jul/44
https://www.exploit-db.com/exploits/37604/

Exploit#

https://www.exploit-db.com/exploits/37604/

History#

Version 12017-08-31Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.