Exploit Command School Student Management System - '/sw/admin_titles.php?id' SQL Injection

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
38952
Проверка EDB
  1. Пройдено
Автор
ATT4CKXT3RR0R1ST
Тип уязвимости
WEBAPPS
Платформа
PHP
CVE
cve-2014-1636
Дата публикации
2014-01-07
Command School Student Management System - '/sw/admin_titles.php?id' SQL Injection
Код:
source: https://www.securityfocus.com/bid/64707/info
        
Command School Student Management System is prone to the following security vulnerabilities:
        
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
        
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
        
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_titles.php?action=edit&id=null+and+1=2+union+select+version()
 
Источник
www.exploit-db.com

Похожие темы