Description
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.
Metrics
CVSS 3.0 8.1/10
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2019/May/7Exploit, Mailing List, Third Party Advisory
- https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
- https://seclists.org/bugtraq/2019/May/22Exploit, Issue Tracking, Mailing List, Third Party Advisory
- https://www.openproject.org/release-notes/openproject-8-3-2/Vendor Advisory
- http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2019/May/7Exploit, Mailing List, Third Party Advisory
- https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
- https://seclists.org/bugtraq/2019/May/22Exploit, Issue Tracking, Mailing List, Third Party Advisory
- https://www.openproject.org/release-notes/openproject-8-3-2/Vendor Advisory
Timeline
- Published
- May 13, 2019
- Last modified
- Jun 17, 2026
- NVD status
- Modified