PT-2014-4266 · Command School · Command School Student Management System

Published 2014-01-22 · Updated 2018-10-30 · CVE-2014-1636

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Command School Student Management System version 1.06.01

Description The issue allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to various PHP files, including "admin school names.php", "admin subjects.php", "admin grades.php", "admin terms.php", "admin school years.php", "admin sgrades.php", "admin media codes 1.php", "admin infraction codes.php", "admin generations.php", "admin relations.php", "admin titles.php", or "health allergies.php" in the "sw/" directory.

Recommendations For Command School Student Management System version 1.06.01, as a temporary workaround, consider restricting access to the id parameter in the affected PHP files until a patch is available. Avoid using the id parameter in the edit actions to the specified PHP files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-1636

Affected Products

Command School Student Management System

References · 28

• 🔥 https://exploit-db.com/exploits/38953 · Exploit
• 🔥 https://exploit-db.com/exploits/38945 · Exploit
• 🔥 https://exploit-db.com/exploits/38954 · Exploit
• 🔥 https://exploit-db.com/exploits/38947 · Exploit
• 🔥 https://exploit-db.com/exploits/38946 · Exploit
• 🔥 https://exploit-db.com/exploits/38952 · Exploit
• 🔥 https://exploit-db.com/exploits/38955 · Exploit
• 🔥 http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html · Exploit
• 🔥 https://exploit-db.com/exploits/38948 · Exploit
• 🔥 https://exploit-db.com/exploits/38949 · Exploit
• 🔥 https://exploit-db.com/exploits/38951 · Exploit
• 🔥 https://exploit-db.com/exploits/38944 · Exploit
• 🔥 https://exploit-db.com/exploits/38950 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1636 · Security Note
• http://osvdb.org/101881 · Note