The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not writable to execute arbitrary php code via a crafted database name.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8677
Reference (s):
- BID:75726
- URL: http://www.securityfocus.com/bid/75726
- EXPLOIT-DB:37604
- URL: https://www.exploit-db.com/exploits/37604/
- FULLDISC:20150710 SOPlanning – Simple Online Planning Tool multiple vulnerabilities