PT-2014-4364 · Command School · Command School Student Management System

Publicado 2014-02-07 · Atualizado 2014-02-21 · CVE-2014-1915

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Command School Student Management System version 1.06.01

Description The issue affects the Command School Student Management System, allowing remote attackers to exploit multiple cross-site request forgery (CSRF) vulnerabilities. This can lead to the hijacking of administrator authentication for changing passwords via the "sw/admin change password.php" API endpoint or adding topics and blog entries to "sw/add topic.php".

Recommendations For Command School Student Management System version 1.06.01, consider disabling access to the sw/admin change password.php and sw/add topic.php API endpoints until a patch is available to prevent exploitation. Restrict the use of these endpoints to minimize the risk of authentication hijacking.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-1915

Produtos afetados

Command School Student Management System

Referências · 7

• 🔥 https://exploit-db.com/exploits/38957 · Exploit
• 🔥 https://exploit-db.com/exploits/38958 · Exploit
• 🔥 http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html · Exploit
• http://osvdb.org/101889 · Nota
• http://securityfocus.com/bid/64707 · Nota
• http://osvdb.org/101890 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1915 · Nota de Segurança