CVE-2024-8503 VICIdial Unauthenticated SQL Injection

2024-09-1019:22:40

CWE-89

KoreLogic

www.cve.org

vicidial

sql injection

unauthenticated

EPSS

0.003

Percentile

65.6%

JSON

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "VICIdial",
    "vendor": "VICIdial",
    "versions": [
      {
        "status": "affected",
        "version": "2.14-917a"
      }
    ]
  }
]