PT-2017-14310 · Ingenious · Ingenious School Management System

Ihsan Sencan · Publicado 2017-10-29 · Atualizado 2017-11-17 · CVE-2017-15957

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ingenious School Management System version 2.3.0

Description The issue allows a student or teacher to upload an arbitrary file through the my profile.php script.

Recommendations For Ingenious School Management System version 2.3.0, restrict access to the my profile.php script to prevent arbitrary file uploads until a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-15957

Produtos afetados

Ingenious School Management System

Referências · 4

• 🔥 https://exploit-db.com/exploits/43102 · Exploit
• https://packetstormsecurity.com/files/144431/Ingenious-School-Management-System-2.3.0-Arbitrary-File-Upload.html · Nota
• https://osv.dev/vulnerability/CVE-2017-15957 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15957 · Nota de Segurança