CVE-2026-40546: Multiple SQL Injections in SOPlanning

Synopsis

Multiple SQL injection vulnerabilities affect SOPlanning version 1.55 and below across several endpoints and parameters. An attacker can reach the vulnerable service over the network using any low-privilege account, with no victim interaction required, and inject arbitrary SQL commands into the database. Successful exploitation gives the attacker full read and write access to database contents, including all stored records. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the SOPlanning service over the network; no local or physical access to the host is necessary.

• AuthenticationRequired

  Any low-privilege account is sufficient; no administrative or elevated credentials are needed to reach the vulnerable endpoints.

• Victim interactionNot required

  The attacker can exploit the vulnerability entirely on their own without any action from a user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental prerequisites required.

Blast Radius

• Reads all data stored in the database, including user credentials, session tokens, scheduling records, and any other persisted application data.
• Modifies or deletes persisted database rows, enabling tampering with planning records, user accounts, or application configuration.
• The availability impact is rated low, meaning the database service remains largely operational but may experience degraded performance or partial disruption under sustained injection activity.
• Because scope is limited to the local application component, the injections do not directly pivot to adjacent systems or services.