PT-2023-1564 · Unknown · Class/Exam Timetabling System

Muhanyun · Publicado 2023-02-26 · Atualizado 2024-05-17 · CVE-2023-1039

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Class and Exam Timetabling System version 1.0

Description The issue is related to the lack of protection against SQL query structure manipulation when handling the password parameter in the index3.php script of the Class and Exam Timetabling System. This can be exploited by a remote attacker to execute arbitrary SQL code. The manipulation of the password argument leads to SQL injection. The attack can be launched remotely.

Recommendations For Class and Exam Timetabling System version 1.0, consider disabling the password parameter handling in the /admin/index3.php file until a patch is available to prevent SQL injection attacks. Restrict access to the /admin/index3.php file to minimize the risk of exploitation. Avoid using the password parameter in the affected POST request until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-01031

CVE-2023-1039

Produtos afetados

Class/Exam Timetabling System

Referências · 6

• 🔥❌ https://github.com/anquanclub/bug_report/blob/main/vendors/Cherylda%20Jardeliza%20Ohiman/Class%20and%20Exam%20Timetabling%20System/SQLi-1.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-1039 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1039 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01031 · Nota de Segurança
• https://vuldb.com/?ctiid.221797 · Nota
• https://vuldb.com/?id.221797 · Nota