PT-2017-14310 · Ingenious · Ingenious School Management System

Ihsan Sencan · Published 2017-10-29 · Updated 2017-11-17 · CVE-2017-15957

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ingenious School Management System version 2.3.0

Description The issue allows a student or teacher to upload an arbitrary file through the my profile.php script.

Recommendations For Ingenious School Management System version 2.3.0, restrict access to the my profile.php script to prevent arbitrary file uploads until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-15957

Affected Products

Ingenious School Management System

References · 4

• 🔥 https://exploit-db.com/exploits/43102 · Exploit
• https://osv.dev/vulnerability/CVE-2017-15957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15957 · Security Note
• https://packetstormsecurity.com/files/144431/Ingenious-School-Management-System-2.3.0-Arbitrary-File-Upload.html · Note