cve/2024/CVE-2024-8503.md

CVE-2024-8503

Description

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.

POC

Reference

• https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/Chocapikk/CVE-2024-8504
• https://github.com/cyb3r-w0lf/nuclei-template-collection
• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/nomi-sec/PoC-in-GitHub