itsourcecode University Management System: ID Manipulation Allows Unauthorized Access

Summary

A security flaw in the itsourcecode University Management System's admin interface allows an attacker to manipulate sensitive data by exploiting how the system handles student IDs. This could lead to unauthorized access to sensitive information. To protect your system, update to the latest version of the software and ensure that all user IDs are validated properly.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
angeljudesuarez	university_management_system	1.0	–

Original title

A security vulnerability has been detected in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /admin_single_student_update.php. The m...

Original description

A security vulnerability has been detected in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /admin_single_student_update.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/dyh1213-wq/cve/issues/2 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.348306 Permissions Required VDB Entry
https://vuldb.com/?id.348306 Third Party Advisory VDB Entry
https://vuldb.com/?submit.763769 Third Party Advisory VDB Entry