PT-2019-14606 · Egpp · Egpp Sistema Integrado De Gestion Academica

Published 2019-09-16 · Updated 2019-09-17 · CVE-2019-16264

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EGPP Sistema Integrado de Gestion Academica (GESAC) version 1

Description The issue concerns a SQL injection vulnerability in the authentication form of the affected software. Specifically, the username parameter is vulnerable, allowing attackers to access the database.

Recommendations For EGPP Sistema Integrado de Gestion Academica (GESAC) version 1, consider restricting access to the authentication form until a patch is available, and avoid using the username parameter in a way that could facilitate SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-16264

Affected Products

Egpp Sistema Integrado De Gestion Academica

References · 3

• 🔥 https://infayer.com/?p=43 · Exploit
• https://osv.dev/vulnerability/CVE-2019-16264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16264 · Security Note