PT-2025-5761 · Unknown · Sourcecodester Responsive E-Learning System

Published 2025-02-05 · Updated 2025-02-06 · CVE-2020-36084

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SourceCodester Responsive E-Learning System version 1.0

Description: The issue allows remote attackers to inject a SQL query in the id field of the "/elearning/delete teacher students.php?id=" endpoint. This enables attackers to execute unauthorized SQL commands.

Recommendations: For SourceCodester Responsive E-Learning System version 1.0, consider disabling the id field in the "/elearning/delete teacher students.php?id=" endpoint until a patch is available. Restrict access to the delete teacher students.php module to minimize the risk of exploitation. Avoid using the id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-36084

Affected Products

Sourcecodester Responsive E-Learning System

References · 5

• 🔥 https://exploit-db.com/exploits/49357 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36084 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36084 · Vendor Advisory
• https://twitter.com/WolfgangSesin/status/1887436455502385432 · Twitter Post
• https://twitter.com/CVEnew/status/1887257445883412719 · Twitter Post