// For flags

CVE-2024-27115

Remote Code Execution through File Upload in SOPlanning before 1.52.02

Severity Score

10.0
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02.

*Credits: Wietse Boonstra, Hidde Smit, Max van der Horst
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
High
High
Integrity
High
High
Availability
High
High
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
High
High
Integrity
High
High
Availability
High
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-02-19 CVE Reserved
  • 2024-09-11 CVE Published
  • 2024-09-11 CVE Updated
  • 2024-09-19 EPSS Updated
  • 2025-01-08 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
  • CAPEC-549: Local Execution of Code
References (2)
URL Tag Source
https://csirt.divd.nl/CVE-2024-27115 Third Party Advisory
URL Date SRC
https://github.com/theexploiters/CVE-2024-27115-Exploit 2025-01-08
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Simple Online Planning
Search vendor "Simple Online Planning"
 SO Planning
Search vendor "Simple Online Planning" for product "SO Planning"
 1.52.01
Search vendor "Simple Online Planning" for product "SO Planning" and version "1.52.01"
en
Affected