CVE-2014-8677

MEDIUM

soplanning < 1.32 - Authenticated Remote Code Execution via Crafted Database Name

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-8677. PoCs published by Huy-Ngoc DAU.

AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in SOPlanning 1.32 and prior, including SQL injection, XSS, path traversal, authentication hash disclosure, and PHP code injection during installation. It provides detailed proof-of-concept examples for each vulnerability.

Description

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not writable to execute arbitrary php code via a crafted database name.

Exploits (1)

exploitdb WORKING POC

by Huy-Ngoc DAU · textwebappsphp

https://www.exploit-db.com/exploits/37604

View Code ZIP pw:eip

The exploit demonstrates multiple vulnerabilities in SOPlanning 1.32 and prior, including SQL injection, XSS, path traversal, authentication hash disclosure, and PHP code injection during installation. It provides detailed proof-of-concept examples for each vulnerability.

Classification

Working Poc 95%

Attack Type

Sqli | Xss | Info Leak | Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: SOPlanning - Simple Online Planning Tool 1.32 and prior

No auth needed

Prerequisites: Access to the target application · Valid session cookie for authenticated vulnerabilities

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter T1005 - Data from Local System

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/75726

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2015/Jul/44

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/37604/

Scores

CVSS v3 5.3

EPSS 0.0349

EPSS Percentile 87.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-284 CWE-94

Status published

Products (1)

soplanning/soplanning < 1.32

Published Aug 31, 2017

Tracked Since Feb 18, 2026