PT-2018-14664 · Unknown · Curriculum Evaluation System

Ihsan Sencan · Publicado 2018-11-16 · Atualizado 2018-12-17 · CVE-2018-18803

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Curriculum Evaluation System version 1.0

Description The issue allows SQL Injection via the login screen. It is related to the files frmCourse.vb and includes/user.vb.

Recommendations For Curriculum Evaluation System version 1.0, consider restricting access to the login screen until a patch is available. As a temporary workaround, review and modify the code in frmCourse.vb and includes/user.vb to prevent SQL Injection attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-18803

Produtos afetados

Curriculum Evaluation System

Referências · 4

• 🔥 https://exploit-db.com/exploits/45719 · Exploit
• 🔥 http://packetstormsecurity.com/files/150011/Curriculum-Evaluation-System-1.0-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18803 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-18803 · Aviso do Fabricante