CVE-2024-27113

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability has been remediated in version 1.52.02.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-271149.8A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is CVE-2024-271159.8A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an atCVE-2024-27126.5A vulnerability, which was classified as critical, has been found in Campcodes Complete Online DJ Booking System 1.0. This issue affects somCVE-2024-271207.5A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticateCVE-2024-271217.2Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary filCVE-2024-271225.4A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authentiCVE-2024-271235.2A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to CVE-2024-271247.5An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2024-271254.8A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated aCVE-2024-271265.4A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authentiCVE-2024-271278.8A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow CVE-2024-271288.8A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,
CVE-2024-27113: Critical severity, CVSS 9.8 | Vulnix