PT-2018-14659 · Unknown · School Management System

Publicado 2018-11-16 · Atualizado 2018-12-18 · CVE-2018-18795

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions School Event Management System version 1.0

Description The issue is related to SQL Injection, which can be exploited via the id parameter in the "student/index.php" or "event/index.php" API endpoints.

Recommendations For School Event Management System version 1.0, consider restricting access to the id parameter in the affected API endpoints until a patch is available. As a temporary workaround, avoid using the id parameter in the "student/index.php" and "event/index.php" endpoints to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-18795

Produtos afetados

School Management System

Referências · 4

• 🔥 http://packetstormsecurity.com/files/150014/School-Event-Management-System-1.0-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/45722 · Exploit
• https://osv.dev/vulnerability/CVE-2018-18795 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18795 · Nota de Segurança