PT-2014-4364 · Command School · Command School Student Management System

Published 2014-02-07 · Updated 2014-02-21 · CVE-2014-1915

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Command School Student Management System version 1.06.01

Description The issue affects the Command School Student Management System, allowing remote attackers to exploit multiple cross-site request forgery (CSRF) vulnerabilities. This can lead to the hijacking of administrator authentication for changing passwords via the "sw/admin change password.php" API endpoint or adding topics and blog entries to "sw/add topic.php".

Recommendations For Command School Student Management System version 1.06.01, consider disabling access to the sw/admin change password.php and sw/add topic.php API endpoints until a patch is available to prevent exploitation. Restrict the use of these endpoints to minimize the risk of authentication hijacking.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-1915

Affected Products

Command School Student Management System

References · 7

• 🔥 https://exploit-db.com/exploits/38957 · Exploit
• 🔥 https://exploit-db.com/exploits/38958 · Exploit
• 🔥 http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1915 · Security Note
• http://osvdb.org/101889 · Note
• http://securityfocus.com/bid/64707 · Note
• http://osvdb.org/101890 · Note