High severity · published May 13, 2019
CVE-2019-11600
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter
8.1
CVSS
80%
EPSS
No
On KEV
Description
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)80.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openproject · Openproject
5.0.0 before 8.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11600
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11600
Exploit
http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.html
Exploit
http://seclists.org/fulldisclosure/2019/May/7
groups.google.com
https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
Exploit
https://seclists.org/bugtraq/2019/May/22
Vendor Advisory
https://www.openproject.org/release-notes/openproject-8-3-2/
More from Openproject
9.9
CVE-2026-25763
Command Injection on OpenProject repositories leads to Remote Code Execution
9.1
CVE-2026-22600
OpenProject is an open-source, web-based project management software
9.0
CVE-2026-24772
OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server
8.8
CVE-2026-24685
OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
8.8
CVE-2021-43830
OpenProject is a web-based project management software