PT-2024-29329 · Unknown · Kashipara Responsive School Management System

Published 2024-08-07 · Updated 2024-10-24 · CVE-2024-41251

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kashipara Responsive School Management System version 3.2.0

Description An issue was found in the /smsa/admin teacher register approval.php and /smsa/admin teacher register approval submit.php API endpoints, allowing remote unauthenticated attackers to view and approve teacher registrations.

Recommendations For Kashipara Responsive School Management System version 3.2.0, consider restricting access to the /smsa/admin teacher register approval.php and /smsa/admin teacher register approval submit.php API endpoints to prevent unauthorized viewing and approval of teacher registrations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-41251

Affected Products

Kashipara Responsive School Management System

References · 5

• 🔥 https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Broken%20Access%20Control%20-%20Admin%20Dashboard%20-%20Registered%20Teacher.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-41251 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41251 · Vendor Advisory
• https://t.me/cvenotify/89955 · Telegram Post
• https://t.me/cvenotify/99432 · Telegram Post