itsourcecode College Management System: Unauthorized Data Access Through Teacher ID

Summary

A security flaw in the College Management System version 1.0 makes it possible for an attacker to access sensitive information by manipulating the teacher ID. This could happen remotely and potentially allow an attacker to view or modify sensitive data. We recommend that the system be patched or updated to a secure version.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
angeljudesuarez	college_management_system	1.0	–

Original title

A flaw has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/teacher-salary.php. This manipulation of the argument teacher_id c...

Original description

A flaw has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/teacher-salary.php. This manipulation of the argument teacher_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/ltranquility/cve_submit/issues/6 Exploit Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.347660 Permissions Required VDB Entry
https://vuldb.com/?id.347660 Third Party Advisory VDB Entry
https://vuldb.com/?submit.758834 Third Party Advisory VDB Entry