VICIdial’s SQL Injection Vulnerability: A Data Breach Waiting to Happen!
An unauthenticated SQL injection vulnerability in VICIdial allows attackers to enumerate database records using time-based techniques. VICIdial does not uniformly sanitize user input, making it vulnerable.
Hot Take:
It looks like VICIdial just won the lottery of vulnerabilities, with a time-based SQL injection that lets anyone play database detective without even logging in. Who needs credentials when you have exploits?
Key Points:
- VICIdial 2.14-917a vulnerable to unauthenticated SQL injection.
- Vulnerability classified under CWE-89 and CVE-2024-8503.
- Lack of consistent input sanitization using “preg_replace” leads to security gaps.
- Exploitable via time-based SQL injection to enumerate database records.
- Plaintext credentials stored in the database by default.
Already a member? Log in here