CVE-2014-8676

MEDIUM NUCLEI

soplanning < 1.32 - Path Traversal via URL Path Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-8676. PoCs published by Huy-Ngoc DAU. A Nuclei detection template is also available.

AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in SOPlanning 1.32 and prior, including SQL injection, XSS, path traversal, authentication hash disclosure, and PHP code injection during installation. It provides detailed proof-of-concept examples for each vulnerability.

Description

Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter.

Exploits (1)

exploitdb WORKING POC

by Huy-Ngoc DAU · textwebappsphp

https://www.exploit-db.com/exploits/37604

View Code ZIP pw:eip

The exploit demonstrates multiple vulnerabilities in SOPlanning 1.32 and prior, including SQL injection, XSS, path traversal, authentication hash disclosure, and PHP code injection during installation. It provides detailed proof-of-concept examples for each vulnerability.

Classification

Working Poc 95%

Attack Type

Sqli | Xss | Info Leak | Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: SOPlanning - Simple Online Planning Tool 1.32 and prior

No auth needed

Prerequisites: Access to the target application · Valid session cookie for authenticated vulnerabilities

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter T1005 - Data from Local System

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Simple Online Planning Tool <1.3.2 - Local File Inclusion

MEDIUMby 0x_Akoko

Shodan: http.html:"soplanning"

FOFA: body="soplanning"

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/75726

Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html

Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/37604/

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2015/Jul/44

Scores

CVSS v3 5.3

EPSS 0.8193

EPSS Percentile 99.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-22

Status published

Products (1)

soplanning/soplanning < 1.32

Published Aug 31, 2017

Tracked Since Feb 18, 2026