CVE-2024-27114

Name of the Vulnerable Software and Affected Versions SO Planning versions prior to 1.52.02

Description A Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, an attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is removed, leading to execution of code on the underlying system.

Recommendations For versions prior to 1.52.02, update to version 1.52.02 to resolve the issue. As a temporary workaround, consider disabling the public view setting until the update is applied. Restrict access to the PHP-file upload feature to minimize the risk of exploitation.