CVE-2024-8503: critical vulnerability in VICIdial
VICIdial Unauthenticated SQL Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It exploitation observed in the wild and has a working public exploit.
ssvc Actcvss 9.8epss 79%
from disclosure to weapon4 days
Published on NVDSep 10
1st PoC+4d
metasploitSep 10
Observed exploitation+190d
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
VICIdial · VICIdialpublic PoCs found — 1
githubgithub.com/Machine-farmer/vicidial-cve-2024-8503-blind-sqli-poc★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — VICIdial
In the same product, most dangerous first.
CVE-2024-8504HIGHVICIdial Authenticated Remote Code ExecutionEPSS 76.2%CVE-2022-34876MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.EPSS 3.4%CVE-2022-34877MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.EPSS 3.4%CVE-2022-34878MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.EPSS 3.4%CVE-2022-34879MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.EPSS 0.5%