Unauthenticated Attacker Can Enumerate Database Records via Time-Based SQL Injection Vulnerability
CVE-2024-8503

Currently unrated

Key Information:

Vendor: VICIdial
Vendor: CVE Published:; 10 September 2024

What is CVE-2024-8503?

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.

References

https://korelogic.com/Resources/Advisories/KL-001-2024-01...

https://www.vicidial.org/vicidial.php

EPSS Score

92% chance of being exploited in the next 30 days.

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 10, 2024