PT-2022-18187 · Sourcecodester · Sourcecodester Simple E-Learning System

Xpn2100 · Published 2022-08-08 · Updated 2022-08-11 · CVE-2022-2704

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Simple E-Learning System (affected versions not specified)

Description A vulnerability was found in the SourceCodester Simple E-Learning System, affecting the file downloadFiles.php. The manipulation of the download argument leads to information disclosure. The attack can be initiated remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-2704

Affected Products

Sourcecodester Simple E-Learning System

References · 5

• 🔥 https://github.com/vuls/vuls/blob/main/Simple%20E-Learning%20System%20downloadFiles.php%20Arbitrary%20File%20Download/Simple%20E-Learning%20System%20downloadFiles.php%20Arbitrary%20File%20Download.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2704 · Security Note
• https://t.me/cvenotify/34381 · Telegram Post
• https://vuldb.com/?id.205828 · Note
• https://t.me/cibsecurity/47718 · Telegram Post