PT-2023-1564 · Unknown · Class/Exam Timetabling System

Muhanyun · Published 2023-02-26 · Updated 2024-05-17 · CVE-2023-1039

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Class and Exam Timetabling System version 1.0

Description The issue is related to the lack of protection against SQL query structure manipulation when handling the password parameter in the index3.php script of the Class and Exam Timetabling System. This can be exploited by a remote attacker to execute arbitrary SQL code. The manipulation of the password argument leads to SQL injection. The attack can be launched remotely.

Recommendations For Class and Exam Timetabling System version 1.0, consider disabling the password parameter handling in the /admin/index3.php file until a patch is available to prevent SQL injection attacks. Restrict access to the /admin/index3.php file to minimize the risk of exploitation. Avoid using the password parameter in the affected POST request until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-01031

CVE-2023-1039

Affected Products

Class/Exam Timetabling System

References · 6

• 🔥❌ https://github.com/anquanclub/bug_report/blob/main/vendors/Cherylda%20Jardeliza%20Ohiman/Class%20and%20Exam%20Timetabling%20System/SQLi-1.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-1039 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01031 · Security Note
• https://vuldb.com/?ctiid.221797 · Note
• https://vuldb.com/?id.221797 · Note