PT-2014-4267 · Command School · Command School Student Management System

Published 2014-01-22 · Updated 2018-10-30 · CVE-2014-1637

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Command School Student Management System version 1.06.01

Description The issue concerns improper access restriction to the "sw/backup/backup ray2.php" endpoint, allowing remote attackers to download a database backup via a direct request.

Recommendations For Command School Student Management System version 1.06.01, restrict access to the "sw/backup/backup ray2.php" endpoint to prevent unauthorized database backup downloads.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-1637

Affected Products

Command School Student Management System

References · 5

• 🔥 https://exploit-db.com/exploits/38956 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1637 · Security Note
• http://securityfocus.com/bid/64707 · Note
• http://osvdb.org/101888 · Note
• http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html · Note