CVE-2024-8503

Summary

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.

Affected Software

Weaknesses

• CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

CVE Program Container

Additional References

• http://seclists.org/fulldisclosure/2024/Sep/25
• http://seclists.org/fulldisclosure/2024/Sep/26

References

• https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt
• https://www.vicidial.org/vicidial.php

• ←Previous
• Next→