# CERT Polska disclosed eight vulnerabilities in SOPlanning software including broken… Published: 2025-11-20 · Severity: high Canonical: https://vorant.io/reports/5789ee0b-9320-4d80-91c8-989ce18a405f/cert-polska-disclosed-eight-vulnerabilities-in-soplanning-software-including > CERT Polska disclosed eight vulnerabilities in SOPlanning software including broken access control, weak password recovery, privilege escalation, and multiple stored XSS flaws, fixed in version 1.55. CERT Polska coordinated the disclosure of eight vulnerabilities affecting SOPlanning, a web-based project planning and scheduling application. The most severe issues include broken access control allowing any authenticated user to manipulate project statuses (CVE-2025-62293), a predictable password recovery token mechanism enabling account takeover through brute-force attacks (CVE-2025-62294), and a privilege escalation flaw allowing users with team management privileges to grant themselves administrative rights (CVE-2025-62730). Additionally, five stored cross-site scripting (XSS) vulnerabilities were identified across multiple endpoints including group forms, tasks, projects, status pages, and public holidays (CVE-2025-62295, CVE-2025-62296, CVE-2025-62297, CVE-2025-62729, CVE-2025-62731). These XSS flaws allow attackers with medium-level privileges or authenticated access to inject malicious HTML and JavaScript that executes when other users access affected pages. All vulnerabilities were responsibly disclosed by Łukasz Jaworski from Pentest Limited and have been remediated in SOPlanning version 1.55. Organizations running SOPlanning should upgrade immediately to mitigate these risks, particularly the authentication bypass and privilege escalation vulnerabilities that could enable complete system compromise. ## Mentioned in this report - Vulnerabilities: CVE-2025-62293, CVE-2025-62294, CVE-2025-62295, CVE-2025-62296, CVE-2025-62297, CVE-2025-62729, CVE-2025-62730, CVE-2025-62731 ## Detection guidance (public sample) ### SOPlanning Password Recovery Endpoint Brute Force Attempt ATT&CK: T1110 Detects repeated requests to the SOPlanning password recovery action, indicative of brute-forcing the predictable recovery token (CVE-2025-62294); high request volume from a single client to this endpoint should be alerted on by the SIEM's rate/threshold logic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: SOPlanning Password Recovery Endpoint Brute Force Attempt id: 848ffbe6-01ce-5f41-adb1-45435b43eddd status: experimental description: 'Detects requests to the SOPlanning password recovery action (used to reset an account password via a token). CVE-2025-62294 documents that recovery tokens are predictable, enabling account takeover via brute force. A high number of requests to this endpoint from the same source in a short window is a strong indicator of an automated brute-force attempt against the recovery token. This condition should be enforced via SIEM-side thresholding (e.g. >20 requests/minute from one source) since Sigma cannot express counts. ' references: - https://cert.pl author: Vorant tags: - attack.t1110 logsource: category: webserver detection: selection: cs-method: GET cs-uri-query|contains: action=recovery condition: selection falsepositives: - Legitimate users repeatedly requesting password resets after forgetting their password - Automated uptime/health-check scripts hitting the recovery endpoint level: medium ``` ### SOPlanning Team Management Self-Admin Privilege Escalation ATT&CK: T1548 Detects a POST request to the SOPlanning team management endpoint that sets an admin/isadmin flag, consistent with CVE-2025-62730 where a user with team-management privileges grants themselves administrative rights. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: SOPlanning Team Management Self-Admin Privilege Escalation id: 708020fc-f642-5ee5-9f2e-67656a94346d status: experimental description: 'Detects HTTP POST requests to SOPlanning''s team/user management endpoint where the request sets an administrative flag (e.g. admin=1 / isadmin=1). CVE-2025-62730 allows a user with team management privileges but without prior administrative rights to escalate to admin by manipulating this parameter. Correlate the requesting session/user identity against known admin accounts to reduce false positives. ' references: - https://cert.pl author: Vorant tags: - attack.t1548 logsource: category: webserver detection: selection: cs-method: POST cs-uri-stem|contains: /team cs-uri-query|contains: - admin=1 - isadmin=1 condition: selection falsepositives: - A legitimate existing administrator promoting another user to admin through the normal UI workflow - Bulk user provisioning scripts run by IT staff that set admin flags for new accounts level: high ``` ### Potential Stored XSS Payload Submitted to SOPlanning Content Endpoints ATT&CK: T1059.007 Detects HTTP requests to SOPlanning project/task/group/status/holiday endpoints containing script tag or javascript: markers, matching the stored XSS pattern described in CVE-2025-62295/62296/62297/62729/62731. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Potential Stored XSS Payload Submitted to SOPlanning Content Endpoints id: c8188445-eb47-58b1-b986-4b659a339db3 status: experimental description: 'Detects requests to SOPlanning content-creation endpoints (group forms, tasks, projects, status, public holidays) whose parameters contain HTML script tags or javascript: URIs. This matches the stored XSS vulnerabilities (CVE-2025-62295, CVE-2025-62296, CVE-2025-62297, CVE-2025-62729, CVE-2025-62731) where an authenticated user with medium privileges injects a payload that later executes in another user''s browser session. ' references: - https://cert.pl author: Vorant tags: - attack.t1059.007 - attack.t1185 logsource: category: webserver detection: selection_method: cs-method: POST selection_endpoint: cs-uri-stem|contains: - /groups - /tasks - /projects - /status - /holidays selection_payload: cs-uri-query|contains: -