itsourcecode School Management System 1.0 SQL Injection Flaw

Summary

A critical security weakness has been discovered in the itsourcecode School Management System 1.0, making it possible for an attacker to inject malicious SQL code. This could allow hackers to access sensitive data or take control of the system. It's recommended to update to the latest version of the software to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
itsourcecode	school_management_system	1.0	–

Original title

A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settings/index.php of the component Setting Handler. This manipulation of the argum...

Original description

A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settings/index.php of the component Setting Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/Ning-BJ/cve/issues/1 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.347984 Permissions Required VDB Entry
https://vuldb.com/?id.347984 Third Party Advisory VDB Entry
https://vuldb.com/?submit.749364 Third Party Advisory VDB Entry