CVE-2024-33722 identifies a SQL Injection vulnerability (CWE-89) in SOPlanning 1.52.00, specifically via the statut[] parameter in projets.php. An authenticated user can exploit this flaw to inject SQL commands, which may lead to unauthorized data access or modification. The vulnerability has a CVSS 3.1 base score of 6.3, reflecting medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation could result in partial loss of confidentiality, integrity, and availability of the affected application data. Since the attacker must be authenticated, the impact is limited to users with some level of access. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to the minimum necessary and monitor for suspicious activity related to the projets.php endpoint. Avoid exposing the application to untrusted users.