PT-2020-12175 · Unknown · School Manage System

Jia-Rong Chen · Published 2020-04-15 · Updated 2020-04-30 · CVE-2020-10505

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The School Manage System versions prior to 2020

Description The issue allows attackers to inject SQL commands into the URL, potentially enabling them to access database schema and username/password information. This is achieved through a union-based injection query string.

Recommendations For versions prior to 2020, consider restricting access to sensitive database information and limiting the ability to inject SQL commands into URLs as a temporary workaround until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-10505

Affected Products

School Manage System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-10505 · Security Note
• https://t.me/cibsecurity/11253 · Telegram Post
• https://twcert.org.tw/tw/cp-132-3530-53d32-1.html · Note
• https://t.me/cvenotify/2747 · Telegram Post
• https://chtsecurity.com/news/be93c576-e421-489f-9453-a462bdd4c90d · Note