Unknown · Daycloud Studentmanage · CVE-2025-2351
Name of the Vulnerable Software and Affected Versions:
DayCloud StudentManage version 1.0
Description:
A critical vulnerability was found in DayCloud StudentManage, affecting the /admin/adminScoreUrl file of the Login Endpoint component. The manipulation of the `query` argument leads to SQL injection. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.
Recommendations:
For DayCloud StudentManage version 1.0, as a temporary workaround, consider restricting access to the `/admin/adminScoreUrl` endpoint until a fix is available. Avoid using the `query` argument in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.