Visual Planning REST API 2.0 Authentication Bypass

A wildcard injection inside a prepared SQL statement was found in an undocumented Visual Planning 8 REST API route. The combination of fuzzy matching (via LIKE operator) and user-controlled input allows exfiltrating the REST API key based on distinguishable server responses. If exploited, attackers are able to gain administrative access to the REST API version 2.0.

access api attackers authentication authentication bypass bypass exploited found injection input key planning rest rest api server sql statement undocumented wildcard