CVE-2024-8503

CVE-2024-8503 is a time-based SQL injection flaw (CWE-89) in VICIdial, an open-source contact center and predictive dialer suite, reachable through its web interface without authentication. An attacker sends crafted unauthenticated HTTP requests whose time-based SQL payloads cause measurable database response delays, allowing records in the underlying database to be inferred and enumerated. Because VICIdial stores user credentials in plaintext in the database by default, successful record extraction can yield working agent and admin passwords, enabling further access to the contact center platform. Any organization running an unpatched VICIdial deployment is affected, particularly where the web portal is reachable from the internet; specific affected version ranges are not specified in the available data. No public proof-of-concept or confirmed in-the-wild exploitation is known and the issue is not yet in CISA KEV, but an EPSS of 80.2% (100th percentile) indicates a high likelihood of exploitation within 30 days.

What to do: Upgrade VICIdial to the latest release containing the vendor's SQL injection fix, distributed through the project's normal SVN/update channels. If patching is delayed, restrict access to the VICIdial web interface to trusted networks or place a WAF/allow-list in front of it. Because credentials are stored in plaintext, rotate agent and admin passwords after patching and review web logs for anomalous request patterns or response delays consistent with time-based SQL injection.