PT-2017-14894 · Unknown · Advance Online Learning Management Script

Ihsan Sencan + 1 · Publicado 2017-12-13 · Atualizado 2017-12-22 · CVE-2017-17599

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advance Online Learning Management Script version 3.1

Description The issue is related to SQL Injection, which can be exploited via the courselist.php subcatid or popcourseid parameters.

Recommendations For Advance Online Learning Management Script version 3.1, consider restricting access to the courselist.php page or validating and sanitizing the subcatid and popcourseid parameters to prevent SQL Injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-17599

Produtos afetados

Advance Online Learning Management Script

Referências · 4

• 🔥 https://exploit-db.com/exploits/43264 · Exploit
• 🔥 https://packetstormsecurity.com/files/145300/Advance-Online-Learning-Management-Script-3.1-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17599 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-17599 · Aviso do Fabricante