PT-2021-17864 · Unknown · Teachers Record Management System

Nhattruong.Blog · Published 2021-07-01 · Updated 2025-05-28 · CVE-2021-28423

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Teachers Record Management System version 1.0

Description: The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the editid GET parameter in "edit-subjects-detail.php" or "edit-teacher-detail.php", or the searchdata POST parameter in "search.php".

Recommendations: For Teachers Record Management System version 1.0, consider disabling the editid and searchdata parameters in the affected files until a patch is available. Restrict access to "edit-subjects-detail.php", "edit-teacher-detail.php", and "search.php" to minimize the risk of exploitation. Avoid using the editid and searchdata parameters in the respective API endpoints until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-28423

Affected Products

Teachers Record Management System

References · 8

• 🔥 https://packetstormsecurity.com/files/163172/Teachers-Record-Management-System-1.0-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/50018 · Exploit
• 🔥 https://nhattruong.blog/2021/05/22/cve-2021-28423-teachers-record-management-system-1-0-searchdata-error-based-sql-injection-authenticated · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-28423 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28423 · Vendor Advisory
• https://t.me/cvenotify/123937 · Telegram Post
• https://t.me/cibsecurity/25864 · Telegram Post
• https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql · Note