SOPlanning patches SQL injection flaw

A SQL injection vulnerability in SOPlanning's audit retention configuration lets privileged users inject malicious SQL that executes when audit functionality is accessed.

CERT Polska coordinated the disclosure of CVE-2026-50644, a SQL injection vulnerability affecting SOPlanning, an open-source project planning and resource scheduling tool. The flaw resides in the audit retention configuration form, where an attacker holding the parameters_all permission can inject SQL commands that are persisted to the configuration. The malicious payload is not executed immediately but is triggered later when the audit functionality is accessed, either by the attacker or by another user, resulting in a stored/second-order SQL injection.

The vulnerability requires an authenticated attacker with elevated (parameters_all) permissions, which limits the exposure primarily to insider threats or accounts that have already been compromised at a privileged level. The issue has been fixed in SOPlanning version 1.56.01. CERT Polska credited Arkadiusz Marta for the responsible disclosure and no evidence of active exploitation was reported.

title: SQL Injection Payload in SOPlanning Audit Retention Configuration Request
id: 4abe4eaf-aa12-597a-9093-89bf98265361
status: experimental
description: 'Detects HTTP requests to the SOPlanning audit retention configuration
  form containing

  SQL injection indicators (UNION SELECT, quote/comment breakout sequences, stacked

  queries, or SQL functions such as SLEEP/BENCHMARK). This corresponds to CVE-2026-50644,

  a stored second-order SQL injection in the parameters_all audit retention configuration

  that is later triggered when the audit functionality is accessed.

  '
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - parametrages
    - parameter
    - config
    - audit
  selection_sqli:
    cs-uri-query|contains:
    - UNION SELECT
    - union select
    - ''' OR ''1''=''1'
    - ''' OR 1=1'
    - --%20
    - /*!
    - SLEEP(
    - sleep(
    - BENCHMARK(
    - ';DROP '
    - ';drop '
    - INFORMATION_SCHEMA
  condition: selection_endpoint and selection_sqli
falsepositives:
- Security scanning tools or authorized penetration tests exercising the audit configuration
  form
- Automated vulnerability scanners probing the application with generic SQLi payloads
level: high

title: SOPlanning Audit Page Access Following Suspicious Configuration Update
id: e66c3fac-d65c-52d1-8edf-b6e968621b14
status: experimental
description: 'Detects HTTP requests to the SOPlanning audit viewing/listing functionality
  where the

  request itself, or a recently preceding configuration write, contains characters
  or

  keywords indicative of a stored SQL injection payload being triggered. This models
  the

  second-order execution stage of CVE-2026-50644 where a malicious value persisted
  in the

  audit retention configuration is later executed when any user opens the audit view.

  '
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1505
logsource:
  category: webserver
detection:
  selection_audit_access:
    cs-uri-stem|contains:
    - audit
    cs-method:
    - GET
  selection_error_indicators:
    cs-uri-query|contains:
    - ''''
    - UNION
    - SELECT
    - sql
  filter_static_assets:
    cs-uri-stem|contains:
    - .js
    - .css
    - .png
    - .jpg
  condition: selection_audit_access and selection_error_indicators and not filter_static_assets
falsepositives:
- Legitimate audit report filtering that includes words like select or union in free-text
  search fields
- Application monitoring or QA scripts that pass raw SQL-like strings while testing
  the audit module
level: medium

title: Authenticated Privileged Request Modifying SOPlanning Retention Configuration
id: 46557b4d-db25-583f-a396-96fb2216438a
status: experimental
description: 'Detects POST requests to the SOPlanning configuration/parameters endpoint
  that update

  audit retention settings. Exploitation of CVE-2026-50644 requires an authenticated
  user

  holding the parameters_all permission to submit a malicious retention value, so
  this rule

  highlights configuration-write activity to that endpoint for correlation with account

  privilege level and subsequent anomalous audit access.

  '
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1190
- attack.t1505
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
    - parametrages
    - parameter
    - config
    cs-uri-query|contains:
    - retention
    - audit
  condition: selection
falsepositives:
- Legitimate administrators updating audit retention duration through the SOPlanning
  UI
- Automated configuration management or backup scripts adjusting retention settings
level: low

Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-50644