← back
CVE-2019-11600

CVE-2019-11600

EPSS 80.0%
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.htmlunverifiedexploitdbwww.exploit-db.com/exploits/46838unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2019/May/7https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJhttps://seclists.org/bugtraq/2019/May/22https://www.openproject.org/release-notes/openproject-8-3-2/