CERT Polska disclosed eight vulnerabilities in SOPlanning software including broken…
CERT Polska disclosed eight vulnerabilities in SOPlanning software including broken access control, weak password recovery, privilege escalation, and multiple stored XSS flaws, fixed in version 1.55.
CERT Polska coordinated the disclosure of eight vulnerabilities affecting SOPlanning, a web-based project planning and scheduling application. The most severe issues include broken access control allowing any authenticated user to manipulate project statuses (CVE-2025-62293), a predictable password recovery token mechanism enabling account takeover through brute-force attacks (CVE-2025-62294), and a privilege escalation flaw allowing users with team management privileges to grant themselves administrative rights (CVE-2025-62730).
Additionally, five stored cross-site scripting (XSS) vulnerabilities were identified across multiple endpoints including group forms, tasks, projects, status pages, and public holidays (CVE-2025-62295, CVE-2025-62296, CVE-2025-62297, CVE-2025-62729, CVE-2025-62731). These XSS flaws allow attackers with medium-level privileges or authenticated access to inject malicious HTML and JavaScript that executes when other users access affected pages.
All vulnerabilities were responsibly disclosed by Łukasz Jaworski from Pentest Limited and have been remediated in SOPlanning version 1.55. Organizations running SOPlanning should upgrade immediately to mitigate these risks, particularly the authentication bypass and privilege escalation vulnerabilities that could enable complete system compromise.
Mentioned in this report
Detection guidance
SOPlanning Password Recovery Endpoint Brute Force Attempt
Detects repeated requests to the SOPlanning password recovery action, indicative of brute-forcing the predictable recovery token (CVE-2025-62294); high request volume from a single client to this endpoint should be alerted on by the SIEM's rate/threshold logic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SOPlanning Password Recovery Endpoint Brute Force Attempt
id: 848ffbe6-01ce-5f41-adb1-45435b43eddd
status: experimental
description: 'Detects requests to the SOPlanning password recovery action (used to
reset an account password via a token).
CVE-2025-62294 documents that recovery tokens are predictable, enabling account
takeover via brute force.
A high number of requests to this endpoint from the same source in a short window
is a strong indicator
of an automated brute-force attempt against the recovery token. This condition should
be enforced via
SIEM-side thresholding (e.g. >20 requests/minute from one source) since Sigma cannot
express counts.
'
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1110
logsource:
category: webserver
detection:
selection:
cs-method: GET
cs-uri-query|contains: action=recovery
condition: selection
falsepositives:
- Legitimate users repeatedly requesting password resets after forgetting their password
- Automated uptime/health-check scripts hitting the recovery endpoint
level: medium
SOPlanning Team Management Self-Admin Privilege Escalation
Detects a POST request to the SOPlanning team management endpoint that sets an admin/isadmin flag, consistent with CVE-2025-62730 where a user with team-management privileges grants themselves administrative rights. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SOPlanning Team Management Self-Admin Privilege Escalation
id: 708020fc-f642-5ee5-9f2e-67656a94346d
status: experimental
description: 'Detects HTTP POST requests to SOPlanning''s team/user management endpoint
where the request sets an
administrative flag (e.g. admin=1 / isadmin=1). CVE-2025-62730 allows a user with
team management
privileges but without prior administrative rights to escalate to admin by manipulating
this parameter.
Correlate the requesting session/user identity against known admin accounts to reduce
false positives.
'
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1548
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /team
cs-uri-query|contains:
- admin=1
- isadmin=1
condition: selection
falsepositives:
- A legitimate existing administrator promoting another user to admin through the
normal UI workflow
- Bulk user provisioning scripts run by IT staff that set admin flags for new accounts
level: high
Potential Stored XSS Payload Submitted to SOPlanning Content Endpoints
Detects HTTP requests to SOPlanning project/task/group/status/holiday endpoints containing script tag or javascript: markers, matching the stored XSS pattern described in CVE-2025-62295/62296/62297/62729/62731. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential Stored XSS Payload Submitted to SOPlanning Content Endpoints
id: c8188445-eb47-58b1-b986-4b659a339db3
status: experimental
description: 'Detects requests to SOPlanning content-creation endpoints (group forms,
tasks, projects, status, public
holidays) whose parameters contain HTML script tags or javascript: URIs. This matches
the stored XSS
vulnerabilities (CVE-2025-62295, CVE-2025-62296, CVE-2025-62297, CVE-2025-62729,
CVE-2025-62731) where
an authenticated user with medium privileges injects a payload that later executes
in another user''s
browser session.
'
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1059.007
- attack.t1185
logsource:
category: webserver
detection:
selection_method:
cs-method: POST
selection_endpoint:
cs-uri-stem|contains:
- /groups
- /tasks
- /projects
- /status
- /holidays
selection_payload:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
condition: selection_method and selection_endpoint and selection_payload
falsepositives:
- Security testing or vulnerability scanning tools intentionally submitting XSS test
strings
- Users legitimately pasting code snippets or URLs containing the word javascript
into task/project descriptions
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/11/CVE-2025-62293
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free