SOPlanning vulnerabilities

Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, allowing remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash.

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker with parameters_all rights can inject SQL commands into the audit configuration form which is then saved. Execution is triggered when the audit functionality is accessed by the attacker or another user.

SOPlanning version 1.55 and below is vulnerable to CSRF in the groupe_save endpoints (create, modify, delete). An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged request.

SOPlanning version 1.55 and below does not verify uploaded file extensions, allowing an authenticated attacker to upload a crafted ZIP archive containing a malicious file.

SOPlanning version 1.55 and below is vulnerable to Path Traversal in backup endpoints. An authenticated remote attacker can exploit a vulnerable endpoint to read and execute files previously added via the backup functionality. Additionally, due to CVE-2026-40543, any backup file can be read by an unauthorized user.

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database. This issue affects SOPlanning version 1.55 and below.

A Reflected XSS vulnerability in SOPlanning (versions 1.55 and below) via the taches parameter. An attacker can craft a malicious URL which, when opened by an authenticated victim, results in arbitrary JavaScript execution in the victim's browser.

Stored XSS vulnerability in SOPlanning version 1.55 and below. An authenticated attacker can upload a crafted ZIP archive with a malicious user.csv file containing JavaScript, which executes when a user clicks the Edit button.

SOPlanning version 1.55 and below does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file with additional sensitive information.

SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.

SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].

SOPlanning is vulnerable to stored XSS in the /feries endpoint. A malicious attacker with access to the public holidays feature can inject arbitrary HTML and JS into the site, which will be rendered/executed when opening multiple pages; by default only administrators and privileged users can access this endpoint. This issue was fixed in version 1.55.

SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves.

SOPlanning is vulnerable to Stored XSS in the /status endpoint. An authenticated attacker can inject arbitrary HTML and JavaScript that will be rendered/executed when opening multiple pages. The issue was fixed in version 1.55.

SOPlanning is vulnerable to Stored XSS in the /projets endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript that will be rendered/executed when opening the edited page. The issue was fixed in version 1.55.

SOPlanning is vulnerable to Stored XSS in the /taches endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript that will be rendered/executed when opening the editor. The issue was fixed in version 1.55.

SOPlanning is vulnerable to Stored XSS in the /groupe_form endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript that will be rendered/executed when opening the editor. The issue was fixed in version 1.55.

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time.

SOPlanning is vulnerable to Broken Access Control in the /status endpoint. Due to missing permission checks in the Project Status functionality, an authenticated attacker can add, edit, and delete any status. The issue was fixed in version 1.55.

SOPlanning v1.53.02 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of proper validation of user input. An attacker can send a specially crafted POST request using the 'LOGOUT_REDIRECT' parameter in '/soplanning/www/process/options.php' to execute a malicious script.