PT-2024-29330 · Unknown · Kashipara Responsive School Management System

Published 2024-08-07 · Updated 2024-08-08 · CVE-2024-41252

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kashipara Responsive School Management System version 3.2.0

Description An issue was found in the /smsa/admin student register approval.php and /smsa/admin student register approval submit.php API endpoints, allowing remote unauthenticated attackers to view and approve student registration.

Recommendations For Kashipara Responsive School Management System version 3.2.0, consider restricting access to the /smsa/admin student register approval.php and /smsa/admin student register approval submit.php API endpoints until a patch is available. As a temporary workaround, limit the functionality of these endpoints to prevent unauthorized student registration approvals. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-41252

Affected Products

Kashipara Responsive School Management System

References · 5

• 🔥 https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Broken%20Access%20Control%20-%20Admin%20Dashboard%20-%20Registered%20Student.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-41252 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41252 · Vendor Advisory
• https://kashipara.com/project/php/12362/responsive-school-management-system-php-project-source-code · Note
• https://t.me/cvenotify/89956 · Telegram Post