CVE-2014-1636
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Command School Student Management System - '/sw/admin_subjects.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_school_names.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/health_allergies.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_titles.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_relations.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_generations.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_infraction_codes.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_media_codes_1.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_sgrades.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_school_years.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_terms.php?id' SQL Injection2014-01-07 · webapps · php · Verified
- Command School Student Management System - '/sw/admin_grades.php?id' SQL Injection2014-01-07 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Doug Poulin | Command School Student Management System | Version 1.06.01 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/101874
- http://osvdb.org/101875
- http://osvdb.org/101876
- http://osvdb.org/101877
- http://osvdb.org/101878
- http://osvdb.org/101879
- http://osvdb.org/101880
- http://osvdb.org/101881
- http://osvdb.org/101882
- http://osvdb.org/101883
- http://osvdb.org/101884
- http://osvdb.org/101885
- http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html
- http://www.securityfocus.com/bid/64707
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90175
- http://osvdb.org/101874
- http://osvdb.org/101875
- http://osvdb.org/101876
- http://osvdb.org/101877
- http://osvdb.org/101878
- http://osvdb.org/101879
- http://osvdb.org/101880
- http://osvdb.org/101881
- http://osvdb.org/101882
- http://osvdb.org/101883