Back to Database
Status published
Unknown
CVE-2024-8503
VICIdial Unauthenticated SQL Injection
Vulnerability Description
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8503
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Jaggar Henry of KoreLogic, Inc.
References
More from VICIdial
View All →CVE-2024-8504
VICIdial Authenticated Remote Code Execution
Unknown
0
CVE-2022-34879
VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.
Medium
6.5
CVE-2022-34878
VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.
Medium
5.5
CVE-2022-34877
VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.
Medium
6.4
CVE-2022-34876
VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.
Medium
5.5
Affected Vendor
VICIdial
View all reports →Affected Software
VICIdial
Vulnerable Versions:
2.14-917a
Timeline
Official Publish:
September 10th, 2024
Last Modified:
November 4th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
No vector data available