Full Report
CERT Polska has received a report about 7 vulnerabilities (from CVE-2026-40543 to CVE-2026-40549) found in SOPlanning software.
Analysis Summary
# Vulnerability: Multiple Security Flaws in SOPlanning
## CVE Details
- **CVE-2026-40543**: Missing Authorization (CWE-862)
- **CVE-2026-40544**: Stored Cross-Site Scripting (XSS) (CWE-79)
- **CVE-2026-40545**: Reflected Cross-Site Scripting (XSS) (CWE-79)
- **CVE-2026-40546**: SQL Injection (CWE-89)
- **CVE-2026-40547**: Path Traversal (CWE-22)
- **CVE-2026-40548**: Unrestricted File Upload (CWE-434)
- **CVE-2026-40549**: Cross-Site Request Forgery (CSRF) (CWE-352)
- **CVSS Score**: Not explicitly provided in the source (Severity ranges from High to Critical based on technical impact).
## Affected Systems
- **Products**: SOPlanning (Planning and scheduling software)
- **Versions**: All versions through 1.55
- **Configurations**: Default installations utilizing the backup functionality and group management modules.
## Vulnerability Description
SOPlanning suffers from a chain of vulnerabilities that allow for complete system compromise:
1. **Broken Access Control**: The software fails to authorize backup endpoints, allowing unauthenticated users to download database archives (containing password hashes) and configuration files.
2. **Injection Flaws**: Improper neutralization of input leads to SQL Injection across various endpoints and both Stored and Reflected XSS.
3. **File Handling Issues**: The software does not validate file extensions in uploaded ZIP archives. Combined with Path Traversal vulnerabilities, an attacker can upload a malicious PHP script (RCE) and move it to a web-accessible directory.
4. **Session Hijacking/Manipulation**: CSRF vulnerabilities allow attackers to perform administrative actions (create/delete groups) via forged requests.
## Exploitation
- **Status**: Reported to CERT Polska; PoC details are described in technical findings.
- **Complexity**: Low to Medium.
- **Attack Vector**: Network (Remote).
## Impact
- **Confidentiality**: High (Access to database, user hashes, and arbitrary file reading).
- **Integrity**: High (Ability to inject scripts, modify groups, and execute arbitrary code).
- **Availability**: High (Ability to delete data or compromise the host server via RCE).
## Remediation
### Patches
- Users are advised to check the vendor's official page for versions higher than 1.55. (Note: As of the disclosure date, specific patch version numbers were not listed in the summary text).
### Workarounds
- **Restrict Access**: Implement network-level access controls (ACLs) to ensure the SOPlanning instance is only accessible via a VPN or trusted IP ranges.
- **Disable Backup Export**: If the backup functionality is not required, consider renaming or removing the `/process/upload_backup` and related backup scripts to prevent unauthorized access.
- **Web Application Firewall (WAF)**: Deploy a WAF with rules to detect SQL Injection, Path Traversal (e.g., `../`), and XSS patterns.
## Detection
- **Indicators of Compromise**:
- Unexpected downloads of ZIP files from backup endpoints.
- Presence of unfamiliar PHP scripts in web-accessible directories.
- Audit logs showing SQL syntax errors or script tags in user/group fields.
- **Detection methods and tools**: Systematic log analysis of the `/process/` directory and monitoring for unauthorized GET/POST requests to `groupe_save`.
## References
- CERT Polska Advisory: [https://cert.pl/en/posts/2026/06/vulnerabilities-in-soplanning/](https://cert.pl/en/posts/2026/06/vulnerabilities-in-soplanning/)
- CVE Records: [https://www.cve.org/CVERecord?id=CVE-2026-40543](https://www.cve.org/CVERecord?id=CVE-2026-40543)
- CWE Definitions: [https://cwe.mitre.org/data/definitions/862.html](https://cwe.mitre.org/data/definitions/862.html)