Vulnerability · Published Sep 11, 2024 · Assigned by DIVD

CVE-2024-27114Remote Code Execution through File Upload in SOPlanning before 1.52.02

Critical 9.8

In plain English

A critical-severity security flaw in SO Planning from Simple Online Planning. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 54.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is removed, leading to execution of code on the underlying system. The vulnerability has been remediated in version 1.52.02.

Affected products (as reported)

Vendor	Product	Versions
Simple Online Planning	SO Planning	before 1.52.01

Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://csirt.divd.nl/CVE-2024-27114 third-party-advisory