itsourcecode College Management System SQL Injection Risk

Summary

An attacker can inject malicious SQL code into the College Management System, potentially allowing them to access sensitive data or take control of the system. This can be done remotely, without needing physical access to the system. Users should update to a fixed version of the system as soon as possible to prevent exploitation.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
angeljudesuarez	college_management_system	1.0	–

Original title

A vulnerability was found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/class-result.php. Performing a manipulation of the argument co...

Original description

A vulnerability was found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/class-result.php. Performing a manipulation of the argument course_code results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

nvd CVSS2.0 5.8

nvd CVSS3.1 7.2

nvd CVSS4.0 5.1

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/ltranquility/cve_submit/issues/8 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.348562 Permissions Required VDB Entry
https://vuldb.com/?id.348562 Third Party Advisory VDB Entry
https://vuldb.com/?submit.765095 Third Party Advisory VDB Entry