SOPlanning patches SQL injection flaw
A SQL injection vulnerability in SOPlanning's audit retention configuration lets privileged users inject malicious SQL that executes when audit functionality is accessed.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of CVE-2026-50644, a SQL injection vulnerability affecting SOPlanning, an open-source project planning and resource scheduling tool. The flaw resides in the audit retention configuration form, where an attacker holding the parameters_all permission can inject SQL commands that are persisted to the configuration. The malicious payload is not executed immediately but is triggered later when the audit functionality is accessed, either by the attacker or by another user, resulting in a stored/second-order SQL injection.
The vulnerability requires an authenticated attacker with elevated (parameters_all) permissions, which limits the exposure primarily to insider threats or accounts that have already been compromised at a privileged level. The issue has been fixed in SOPlanning version 1.56.01. CERT Polska credited Arkadiusz Marta for the responsible disclosure and no evidence of active exploitation was reported.
Mentioned in this report
Detection guidance
SQL Injection Payload in SOPlanning Audit Retention Configuration Request
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to SOPlanning's audit retention configuration endpoint containing SQL injection meta-characters or keywords, consistent with CVE-2026-50644 stored SQLi. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Payload in SOPlanning Audit Retention Configuration Request
id: 4abe4eaf-aa12-597a-9093-89bf98265361
status: experimental
description: 'Detects HTTP requests to the SOPlanning audit retention configuration
form containing
SQL injection indicators (UNION SELECT, quote/comment breakout sequences, stacked
queries, or SQL functions such as SLEEP/BENCHMARK). This corresponds to CVE-2026-50644,
a stored second-order SQL injection in the parameters_all audit retention configuration
that is later triggered when the audit functionality is accessed.
'
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- parametrages
- parameter
- config
- audit
selection_sqli:
cs-uri-query|contains:
- UNION SELECT
- union select
- ''' OR ''1''=''1'
- ''' OR 1=1'
- --%20
- /*!
- SLEEP(
- sleep(
- BENCHMARK(
- ';DROP '
- ';drop '
- INFORMATION_SCHEMA
condition: selection_endpoint and selection_sqli
falsepositives:
- Security scanning tools or authorized penetration tests exercising the audit configuration
form
- Automated vulnerability scanners probing the application with generic SQLi payloads
level: high
SOPlanning Audit Page Access Following Suspicious Configuration Update
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects requests to the SOPlanning audit functionality that carry SQL injection indicators in parameters, indicating the second-order trigger of a previously stored malicious payload in the retention configuration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SOPlanning Audit Page Access Following Suspicious Configuration Update
id: e66c3fac-d65c-52d1-8edf-b6e968621b14
status: experimental
description: 'Detects HTTP requests to the SOPlanning audit viewing/listing functionality
where the
request itself, or a recently preceding configuration write, contains characters
or
keywords indicative of a stored SQL injection payload being triggered. This models
the
second-order execution stage of CVE-2026-50644 where a malicious value persisted
in the
audit retention configuration is later executed when any user opens the audit view.
'
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1505
logsource:
category: webserver
detection:
selection_audit_access:
cs-uri-stem|contains:
- audit
cs-method:
- GET
selection_error_indicators:
cs-uri-query|contains:
- ''''
- UNION
- SELECT
- sql
filter_static_assets:
cs-uri-stem|contains:
- .js
- .css
- .png
- .jpg
condition: selection_audit_access and selection_error_indicators and not filter_static_assets
falsepositives:
- Legitimate audit report filtering that includes words like select or union in free-text
search fields
- Application monitoring or QA scripts that pass raw SQL-like strings while testing
the audit module
level: medium
Authenticated Privileged Request Modifying SOPlanning Retention Configuration
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects POST requests updating the SOPlanning audit retention configuration submitted by an authenticated session, useful for identifying the initial injection step of CVE-2026-50644 which requires the parameters_all privilege. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Authenticated Privileged Request Modifying SOPlanning Retention Configuration
id: 46557b4d-db25-583f-a396-96fb2216438a
status: experimental
description: 'Detects POST requests to the SOPlanning configuration/parameters endpoint
that update
audit retention settings. Exploitation of CVE-2026-50644 requires an authenticated
user
holding the parameters_all permission to submit a malicious retention value, so
this rule
highlights configuration-write activity to that endpoint for correlation with account
privilege level and subsequent anomalous audit access.
'
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1190
- attack.t1505
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- parametrages
- parameter
- config
cs-uri-query|contains:
- retention
- audit
condition: selection
falsepositives:
- Legitimate administrators updating audit retention duration through the SOPlanning
UI
- Automated configuration management or backup scripts adjusting retention settings
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-50644
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs