Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2024-50830: Kashipara E-learning Management System Calendar Vulnerability
CVE-2024-50830 · published 1 year ago
Summary
Attackers can inject malicious SQL code into the calendar feature of the Kashipara E-learning Management System, potentially accessing sensitive data or disrupting the system. This issue affects the calendar feature and could allow unauthorized access to the system. To protect your system, update to a fixed version or use input validation to prevent malicious SQL code from being injected.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| lopalopa | e-learning_management_system |
1.0 cpe:2.3:a:lopalopa:e-learning_management_system:1.0:*:*:*:*:*:*:* |
Original advisory text
A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Project 1.0 via the date_start, date_end, and title parameters.
A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Project 1.0 via the date_start, date_end, and title parameters.
References
- https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%2... Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-89SQL Injection
Timeline
Published14 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-50830 · NVD
Track software like this
Free during beta