PT-2014-4267 · Command School · Command School Student Management System

Publicado 2014-01-22 · Atualizado 2018-10-30 · CVE-2014-1637

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Command School Student Management System version 1.06.01

Description The issue concerns improper access restriction to the "sw/backup/backup ray2.php" endpoint, allowing remote attackers to download a database backup via a direct request.

Recommendations For Command School Student Management System version 1.06.01, restrict access to the "sw/backup/backup ray2.php" endpoint to prevent unauthorized database backup downloads.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-1637

Produtos afetados

Command School Student Management System

Referências · 5

• 🔥 https://exploit-db.com/exploits/38956 · Exploit
• http://securityfocus.com/bid/64707 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1637 · Nota de Segurança
• http://osvdb.org/101888 · Nota
• http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html · Nota