PT-2019-19918 · Eclass · Eclass Platform

Published 2019-07-25 · Updated 2019-10-09 · CVE-2019-9885

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eClass platform version ip.2.5.10.2.1

Description The issue allows an attacker to execute SQL commands via the "/admin/academic/studenview left.php" API endpoint, specifically by manipulating the StudentID parameter.

Recommendations For eClass platform version ip.2.5.10.2.1, consider restricting access to the "/admin/academic/studenview left.php" API endpoint to minimize the risk of exploitation. Avoid using the StudentID parameter in this endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-9885

Affected Products

Eclass Platform

References · 5

• 🔥 https://zeroday.hitcon.org/vulnerability/ZD-2019-00333 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9885 · Security Note
• http://surl.twcert.org.tw/eBDZP · Note
• https://tvn.twcert.org.tw/taiwanvn/TVN-201904005 · Note