itsourcecode Society Management System SQL Injection via Student ID

Summary

The itsourcecode Society Management System version 1.0 has a bug that allows hackers to potentially inject malicious SQL code into its database. This could happen if an attacker manipulates the student ID input. To protect your system, update to a fixed version or apply a patch if available.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
angeljudesuarez	society_management_system	1.0	–

Original title

A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/check_studid.php. Executing a manipulatio...

Original description

A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/check_studid.php. Executing a manipulation of the argument student_id can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/DeelBran-7/hyf/issues/1 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.348305 Permissions Required VDB Entry
https://vuldb.com/?id.348305 Third Party Advisory VDB Entry
https://vuldb.com/?submit.763757 Third Party Advisory VDB Entry