CVE-2024-8503 — VICIdial Unauthenticated SQL Injection

CVE-2024-8503

VICIdial Unauthenticated SQL Injection PUBLISHED

Description (CNA)

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.

Affected (CNA)

Vendor / product	Versions
VICIdial / VICIdial	affected 2.14-917a

CWE

CWE-89

References

https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt
https://www.vicidial.org/vicidial.php

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2024/Sep/25
http://seclists.org/fulldisclosure/2024/Sep/26