Vulnerabilities in SOPlanning software

CERT Polska published a coordinated disclosure of seven CVEs affecting SOPlanning (≤1.55). The issues include missing authorization allowing unauthenticated retrieval of backup archives containing user databases and password hashes; stored and reflected XSS enabling JavaScript execution in authenticated users' browsers; SQL injection across multiple endpoints that can lead to full database compromise; path traversal and unrestricted file upload which—when combined—can place and execute arbitrary files on the server; and CSRF vulnerabilities in group management endpoints. Together these vulnerabilities permit data exfiltration, account compromise, and potential remote code execution.