PT-2018-14664 · Unknown · Curriculum Evaluation System

Ihsan Sencan · Published 2018-11-16 · Updated 2018-12-17 · CVE-2018-18803

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Curriculum Evaluation System version 1.0

Description The issue allows SQL Injection via the login screen. It is related to the files frmCourse.vb and includes/user.vb.

Recommendations For Curriculum Evaluation System version 1.0, consider restricting access to the login screen until a patch is available. As a temporary workaround, review and modify the code in frmCourse.vb and includes/user.vb to prevent SQL Injection attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-18803

Affected Products

Curriculum Evaluation System

References · 4

• 🔥 https://exploit-db.com/exploits/45719 · Exploit
• 🔥 http://packetstormsecurity.com/files/150011/Curriculum-Evaluation-System-1.0-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18803 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18803 · Vendor Advisory