PT-2024-29326 · Unknown · Kashipara Responsive School Management System

Published 2024-08-07 · Updated 2024-08-08 · CVE-2024-41248

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kashipara Responsive School Management System version 3.2.0

Description An issue was found in the Kashipara Responsive School Management System, specifically in the /smsa/add subject.php and /smsa/add subject submit.php API endpoints, allowing remote unauthenticated attackers to add new subject entries due to incorrect access control.

Recommendations For Kashipara Responsive School Management System version 3.2.0, consider restricting access to the /smsa/add subject.php and /smsa/add subject submit.php API endpoints until a patch is available to prevent unauthorized addition of subject entries.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-41248

Affected Products

Kashipara Responsive School Management System

References · 3

• 🔥 https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Broken%20Access%20Control%20-%20Admin%20Master%20-%20Add%20Subject.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2024-41248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41248 · Security Note