SOPlanning Audit Retention SQL Injection Vulnerability
SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL commands into the audit configuration form which is then saved. The execution is triggered when the audit functionality is accessed (by the attacker or another user). This issue was fixed in version 1.56.01.
Quick answer
SOPlanning should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- SOPlanning before 1.56.01
Fixed versions
- 1.56.01
How to fix it
SOPlanning before 1.56.01 is affected by CVE-2026-50644. The audit retention configuration can store SQL injection payloads when an attacker has parameters_all rights, so the fix is to upgrade and review administrative configuration changes.
- Inventory all SOPlanning installations and identify internet-facing or shared instances.
- Upgrade SOPlanning to 1.56.01 or later.
- Restrict parameters_all access to trusted administrators until the upgrade is complete.
- Review audit retention settings and saved configuration values for injected SQL syntax.
- Inspect database logs for unexpected queries triggered from the audit feature.
- Rotate database credentials if unauthorized query execution or data access is suspected.
- Back up the database before patching and verify the application schema after the upgrade.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm SOPlanning reports version 1.56.01 or later.
- Submit a safe SQL metacharacter test in staging and confirm the audit setting is parameterized or rejected.
- Confirm audit retention pages still work for legitimate administrators.
- Review database logs after patching for blocked or failed injection attempts.
- Run a Fixnx scan and confirm public SOPlanning exposure is reviewed.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-50644?
SOPlanning versions listed as affected should be reviewed: SOPlanning before 1.56.01.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
Why can this risk appear in multiple categories?
A vulnerability can belong to more than one platform or ecosystem. Fixnx keeps one canonical risk page while also listing it in every relevant category.