CVE-2024-9573
📋 TL;DR
This SQL injection vulnerability in SOPlanning versions before 1.45 allows remote attackers to execute arbitrary SQL queries through the 'by' parameter in groupe_list.php. This could enable extraction of all database information including user credentials, planning data, and system information. Organizations using SOPlanning versions <1.45 are affected.
💻 Affected Systems
- SOPlanning
📦 What is this software?
Soplanning by Soplanning
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, credential theft, potential lateral movement to other systems, and full application control.
Likely Case
Extraction of sensitive planning data, user information, and potential privilege escalation within the SOPlanning application.
If Mitigated
Limited to read-only data extraction if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
SQL injection vulnerabilities are well-understood attack vectors with many available tools and techniques for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.45
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-soplanning
Restart Required: Yes
Instructions:
1. Download SOPlanning version 1.45 or later from the official source. 2. Backup your current installation and database. 3. Replace the existing files with the patched version. 4. Restart the web server service.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns in the 'by' parameter
WAF-specific configuration commands vary by vendor
Input Validation Filter
allAdd input validation to filter SQL keywords from the 'by' parameter
Modify /soplanning/www/groupe_list.php to sanitize the 'by' parameter input
🧯 If You Can't Patch
- Block external access to /soplanning/www/groupe_list.php using firewall rules or web server configuration
- Implement strict network segmentation to isolate the SOPlanning server from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check if SOPlanning version is below 1.45 by examining the application version in the interface or checking the installation filesCheck Version:
Check the SOPlanning interface or examine the application files for version informationVerify Fix Applied:
Verify the version has been updated to 1.45 or later and test the vulnerable endpoint with safe SQL injection test payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple requests to groupe_list.php with SQL keywords in parameters
- Database error messages containing SQL syntax
Network Indicators:
- HTTP requests to /soplanning/www/groupe_list.php containing SQL injection patterns in the 'by' parameter
SIEM Query:
source="web_server_logs" AND uri="/soplanning/www/groupe_list.php" AND (param="by" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR 1=1")