CVE-2019-11600

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.

• CWE-89

• http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/May/7Exploit, Mailing List, Third Party Advisory
• https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
• https://seclists.org/bugtraq/2019/May/22Exploit, Issue Tracking, Mailing List, Third Party Advisory
• https://www.openproject.org/release-notes/openproject-8-3-2/Vendor Advisory
• http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/May/7Exploit, Mailing List, Third Party Advisory
• https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
• https://seclists.org/bugtraq/2019/May/22Exploit, Issue Tracking, Mailing List, Third Party Advisory
• https://www.openproject.org/release-notes/openproject-8-3-2/Vendor Advisory

Published

May 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11595In uBlock before 0.9.5.15, the $rewrite filter option allows…
• CVE-2019-11596In memcached before 1.5.14, a NULL pointer dereference was f…
• CVE-2019-11597In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer ov…
• CVE-2019-11598In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer ov…
• CVE-2019-11599The coredump implementation in the Linux kernel before 5.0.1…7
• CVE-2019-1160Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-11601A directory traversal vulnerability in remote access to back…7.5
• CVE-2019-11602Leakage of stack traces in remote access to backup & restore…5.3
• CVE-2019-11603A HTTP Traversal Attack in earlier versions than ProSyst mBS…7.5
• CVE-2019-11604An issue was discovered in Quest KACE Systems Management App…
• CVE-2019-11605An issue was discovered in GitLab Community and Enterprise E…7.5
• CVE-2019-11606doorGets 7.0 has a sensitive information disclosure vulnerab…