CVE-2024-8503 VICIdial Unauthenticated SQL Injection

2024-09-1019:22:40

CWE-89

KoreLogic

github.com

vicidial

sql injection

database security

plaintext credentials

AI Score

8.2

Confidence

Low

EPSS

0.003

Percentile

65.6%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:vicidial:vicidial:2.14-917a:*:*:*:*:*:*:*"
    ],
    "vendor": "vicidial",
    "product": "vicidial",
    "versions": [
      {
        "status": "affected",
        "version": "2.14-917a"
      }
    ],
    "defaultStatus": "unknown"
  }
]