ID EDB-ID:38948Type exploitdbReporter AtT4CKxT3rR0r1ST Modified 2014-01-07T00:00:00
Description
Command School Student Management System /sw/admin_media_codes_1.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform
source: http://www.securityfocus.com/bid/64707/info
Command School Student Management System is prone to the following security vulnerabilities:
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected.
http://www.example.com/sw/admin_media_codes_1.php?action=edit&id=null+and+1=2+union+select+version(),2,3
{"id": "EDB-ID:38948", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_media_codes_1.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_media_codes_1.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38948/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:11:20", "viewCount": 9, "enchantments": {"dependencies": {"modified": "2016-02-04T09:11:20", "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38950"], "type": "exploitdb"}], "rev": 2}, "score": {"modified": "2016-02-04T09:11:20", "rev": 2, "value": 7.1, "vector": "NONE"}, "vulnersScore": 7.1}, "sourceHref": "https://www.exploit-db.com/download/38948/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_media_codes_1.php?action=edit&id=null+and+1=2+union+select+version(),2,3", "osvdbidlist": ["101880"], "immutableFields": [], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "edition": 2, "scheme": null}
{"cve": [{"id": "CVE-2014-1636", "bulletinFamily": "NVD", "title": "CVE-2014-1636", "description": "Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.", "published": "2014-01-22T19:55:00", "modified": "2018-10-30T16:26:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1636", "reporter": "cve@mitre.org", "references": ["http://osvdb.org/101882", "http://osvdb.org/101879", "http://osvdb.org/101881", "http://osvdb.org/101878", "http://osvdb.org/101880", "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html", "http://osvdb.org/101874", "http://osvdb.org/101885", "http://osvdb.org/101877", "http://osvdb.org/101876", "http://osvdb.org/101875", "http://www.securityfocus.com/bid/64707", "https://exchange.xforce.ibmcloud.com/vulnerabilities/90175", "http://osvdb.org/101884", "http://osvdb.org/101883"], "cvelist": ["CVE-2014-1636"], "type": "cve", "lastseen": "2021-04-22T23:44:04", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "doug_poulin:command_school_student_management_system", "name": "doug poulin command school student management system", "operator": "eq", "version": "1.06.01"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:doug_poulin:command_school_student_management_system:1.06.01"], "cpe23": ["cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2014-1636"], "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-89"], "description": "Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-10-03T12:01:14", "references": [{"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38944", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "rev": 2}, "score": {"modified": "2020-10-03T12:01:14", "rev": 2, "value": 7.5, "vector": "NONE"}}, "extraReferences": [], "hash": "85b64651d505cab87fe58cf1e947024bebac07ff8941afbb072736407025f2ea", "hashmap": [{"hash": "43f4b6b95eb3046e4e14b7c691f315ad", "key": "cpe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "cb275da4521908fd49d88e92b1a50f8d", "key": "href"}, {"hash": "67973ac34b044cc2b5562dd111607884", "key": "published"}, {"hash": "3636eb8d09a7da90ac6659a2affcbd18", "key": "references"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "6adf5d5165eb5eeb1ef62532047be64e", "key": "affectedSoftware"}, {"hash": "915c487357bf8f8ff5ec2cf7bd9d5671", "key": "cpeConfiguration"}, {"hash": "76f67423deff85bbb323c02e9851a7f4", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "29a4dbbc9894fc0ef48d339ccf049edf", "key": "modified"}, {"hash": "27c7580c75f8189a2ddd31c96c2f7e2b", "key": "cvss2"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8bd3532055b892de117a92f5dea24ef3", "key": "cpe23"}, {"hash": "4994f73f97fee1825d38aac7bee9aefe", "key": "cwe"}, {"hash": "0b053db5674b87efff89989a8a720df3", "key": "cvss"}, {"hash": "72010bff7ae3770abe1fa88c1374202d", "key": "description"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1636", "id": "CVE-2014-1636", "lastseen": "2020-10-03T12:01:14", "modified": "2018-10-30T16:26:00", "objectVersion": "1.3", "published": "2014-01-22T19:55:00", "references": ["http://osvdb.org/101882", "http://osvdb.org/101879", "http://osvdb.org/101881", "http://osvdb.org/101878", "http://osvdb.org/101880", "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html", "http://osvdb.org/101874", "http://osvdb.org/101885", "http://osvdb.org/101877", "http://osvdb.org/101876", "http://osvdb.org/101875", "http://www.securityfocus.com/bid/64707", "https://exchange.xforce.ibmcloud.com/vulnerabilities/90175", "http://osvdb.org/101884", "http://osvdb.org/101883"], "reporter": "cve@mitre.org", "title": "CVE-2014-1636", "type": "cve", "viewCount": 1}, "differentElements": ["extraReferences"], "edition": 3, "lastseen": "2020-10-03T12:01:14"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "doug_poulin:command_school_student_management_system", "name": "doug poulin command school student management system", "operator": "eq", "version": "1.06.01"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:doug_poulin:command_school_student_management_system:1.06.01"], "cpe23": ["cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*"], "cpeConfiguration": {}, "cvelist": ["CVE-2014-1636"], "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-89"], "description": "Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-09-21T14:15:40", "references": [{"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38950"], "type": "exploitdb"}], "rev": 2}, "score": {"modified": "2020-09-21T14:15:40", "rev": 2, "value": 7.5, "vector": "NONE"}}, "hash": "923d269e5a857deb0493e6f30396d8fa0ddd7d1813d239eec59b871debc451a2", "hashmap": [{"hash": "43f4b6b95eb3046e4e14b7c691f315ad", "key": "cpe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "cb275da4521908fd49d88e92b1a50f8d", "key": "href"}, {"hash": "67973ac34b044cc2b5562dd111607884", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpeConfiguration"}, {"hash": "3636eb8d09a7da90ac6659a2affcbd18", "key": "references"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "6adf5d5165eb5eeb1ef62532047be64e", "key": "affectedSoftware"}, {"hash": "76f67423deff85bbb323c02e9851a7f4", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "29a4dbbc9894fc0ef48d339ccf049edf", "key": "modified"}, {"hash": "27c7580c75f8189a2ddd31c96c2f7e2b", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8bd3532055b892de117a92f5dea24ef3", "key": "cpe23"}, {"hash": "4994f73f97fee1825d38aac7bee9aefe", "key": "cwe"}, {"hash": "0b053db5674b87efff89989a8a720df3", "key": "cvss"}, {"hash": "72010bff7ae3770abe1fa88c1374202d", "key": "description"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1636", "id": "CVE-2014-1636", "lastseen": "2020-09-21T14:15:40", "modified": "2018-10-30T16:26:00", "objectVersion": "1.3", "published": "2014-01-22T19:55:00", "references": ["http://osvdb.org/101882", "http://osvdb.org/101879", "http://osvdb.org/101881", "http://osvdb.org/101878", "http://osvdb.org/101880", "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html", "http://osvdb.org/101874", "http://osvdb.org/101885", "http://osvdb.org/101877", "http://osvdb.org/101876", "http://osvdb.org/101875", "http://www.securityfocus.com/bid/64707", "https://exchange.xforce.ibmcloud.com/vulnerabilities/90175", "http://osvdb.org/101884", "http://osvdb.org/101883"], "reporter": "cve@mitre.org", "title": "CVE-2014-1636", "type": "cve", "viewCount": 0}, "differentElements": ["cpeConfiguration"], "edition": 2, "lastseen": "2020-09-21T14:15:40"}, {"bulletin": {"affectedSoftware": [{"name": "doug_poulin command_school_student_management_system", "operator": "eq", "version": "1.06.01"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:doug_poulin:command_school_student_management_system:1.06.01"], "cpe23": ["cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*"], "cvelist": ["CVE-2014-1636"], "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-89"], "description": "Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.", "edition": 1, "enchantments": {"dependencies": {"modified": "2019-05-29T18:13:44", "references": [{"idList": ["EDB-ID:38955", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38950"], "type": "exploitdb"}], "rev": 2}, "score": {"modified": "2019-05-29T18:13:44", "rev": 2, "value": 7.5, "vector": "NONE"}}, "hash": "21798ff87d06b46559469dff61b1586c227dae0fdc4ec2ed061bd9ac18e9e4a1", "hashmap": [{"hash": "43f4b6b95eb3046e4e14b7c691f315ad", "key": "cpe"}, {"hash": "cb275da4521908fd49d88e92b1a50f8d", "key": "href"}, {"hash": "67973ac34b044cc2b5562dd111607884", "key": "published"}, {"hash": "3636eb8d09a7da90ac6659a2affcbd18", "key": "references"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "76f67423deff85bbb323c02e9851a7f4", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "29a4dbbc9894fc0ef48d339ccf049edf", "key": "modified"}, {"hash": "27c7580c75f8189a2ddd31c96c2f7e2b", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8bd3532055b892de117a92f5dea24ef3", "key": "cpe23"}, {"hash": "4994f73f97fee1825d38aac7bee9aefe", "key": "cwe"}, {"hash": "0b053db5674b87efff89989a8a720df3", "key": "cvss"}, {"hash": "72010bff7ae3770abe1fa88c1374202d", "key": "description"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "32b951ba7be9ca89131e1c6cd3960d12", "key": "affectedSoftware"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1636", "id": "CVE-2014-1636", "lastseen": "2019-05-29T18:13:44", "modified": "2018-10-30T16:26:00", "objectVersion": "1.3", "published": "2014-01-22T19:55:00", "references": ["http://osvdb.org/101882", "http://osvdb.org/101879", "http://osvdb.org/101881", "http://osvdb.org/101878", "http://osvdb.org/101880", "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html", "http://osvdb.org/101874", "http://osvdb.org/101885", "http://osvdb.org/101877", "http://osvdb.org/101876", "http://osvdb.org/101875", "http://www.securityfocus.com/bid/64707", "https://exchange.xforce.ibmcloud.com/vulnerabilities/90175", "http://osvdb.org/101884", "http://osvdb.org/101883"], "reporter": "cve@mitre.org", "title": "CVE-2014-1636", "type": "cve", "viewCount": 0}, "differentElements": ["affectedSoftware"], "edition": 1, "lastseen": "2019-05-29T18:13:44"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "doug_poulin:command_school_student_management_system", "name": "doug poulin command school student management system", "operator": "eq", "version": "1.06.01"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:doug_poulin:command_school_student_management_system:1.06.01"], "cpe23": ["cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2014-1636"], "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-89"], "description": "Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.", "edition": 4, "enchantments": {"dependencies": {"modified": "2021-02-02T06:14:26", "references": [{"idList": ["EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "rev": 2}, "score": {"modified": "2021-02-02T06:14:26", "rev": 2, "value": 7.5, "vector": "NONE"}}, "extraReferences": [{"name": "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html", "refsource": "MISC", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html"}, {"name": "101877", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101877"}, {"name": "64707", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/64707"}, {"name": "101884", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101884"}, {"name": "101874", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101874"}, {"name": "101879", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101879"}, {"name": "101880", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101880"}, {"name": "commandschool-id-sql-injection(90175)", "refsource": "XF", "tags": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90175"}, {"name": "101875", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101875"}, {"name": "101883", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101883"}, {"name": "101878", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101878"}, {"name": "101876", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101876"}, {"name": "101885", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101885"}, {"name": "101881", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101881"}, {"name": "101882", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101882"}], "hash": "6be179dbca73639445ed596d8f07b61732d07585cf8cad72401fb1563284eec1", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "43f4b6b95eb3046e4e14b7c691f315ad", "key": "cpe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "cb275da4521908fd49d88e92b1a50f8d", "key": "href"}, {"hash": "67973ac34b044cc2b5562dd111607884", "key": "published"}, {"hash": "3636eb8d09a7da90ac6659a2affcbd18", "key": "references"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "6adf5d5165eb5eeb1ef62532047be64e", "key": "affectedSoftware"}, {"hash": "915c487357bf8f8ff5ec2cf7bd9d5671", "key": "cpeConfiguration"}, {"hash": "c2908b4c3a94f79c090a9fd32cba7265", "key": "extraReferences"}, {"hash": "76f67423deff85bbb323c02e9851a7f4", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "29a4dbbc9894fc0ef48d339ccf049edf", "key": "modified"}, {"hash": "27c7580c75f8189a2ddd31c96c2f7e2b", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8bd3532055b892de117a92f5dea24ef3", "key": "cpe23"}, {"hash": "4994f73f97fee1825d38aac7bee9aefe", "key": "cwe"}, {"hash": "0b053db5674b87efff89989a8a720df3", "key": "cvss"}, {"hash": "72010bff7ae3770abe1fa88c1374202d", "key": "description"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1636", "id": "CVE-2014-1636", "immutableFields": [], "lastseen": "2021-02-02T06:14:26", "modified": "2018-10-30T16:26:00", "objectVersion": "1.5", "published": "2014-01-22T19:55:00", "references": ["http://osvdb.org/101882", "http://osvdb.org/101879", "http://osvdb.org/101881", "http://osvdb.org/101878", "http://osvdb.org/101880", "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html", "http://osvdb.org/101874", "http://osvdb.org/101885", "http://osvdb.org/101877", "http://osvdb.org/101876", "http://osvdb.org/101875", "http://www.securityfocus.com/bid/64707", "https://exchange.xforce.ibmcloud.com/vulnerabilities/90175", "http://osvdb.org/101884", "http://osvdb.org/101883"], "reporter": "cve@mitre.org", "title": "CVE-2014-1636", "type": "cve", "viewCount": 3}, "different_elements": ["cpeConfiguration"], "edition": 4, "lastseen": "2021-02-02T06:14:26"}], "edition": 5, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "6adf5d5165eb5eeb1ef62532047be64e"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "43f4b6b95eb3046e4e14b7c691f315ad"}, {"key": "cpe23", "hash": "8bd3532055b892de117a92f5dea24ef3"}, {"key": "cpeConfiguration", "hash": "f0d8e41a3328c727f4c2d8aa868d84c5"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "0b053db5674b87efff89989a8a720df3"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "4994f73f97fee1825d38aac7bee9aefe"}, {"key": "description", "hash": "72010bff7ae3770abe1fa88c1374202d"}, {"key": "extraReferences", "hash": "c2908b4c3a94f79c090a9fd32cba7265"}, {"key": "href", "hash": "cb275da4521908fd49d88e92b1a50f8d"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "29a4dbbc9894fc0ef48d339ccf049edf"}, {"key": "published", "hash": "67973ac34b044cc2b5562dd111607884"}, {"key": "references", "hash": "3636eb8d09a7da90ac6659a2affcbd18"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "76f67423deff85bbb323c02e9851a7f4"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "5ce30b18a00acbd6ac7b1150a4dd82fc5aab7a9be328ebe02eaf608d3f39253a", "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38952", "EDB-ID:38953", "EDB-ID:38950", "EDB-ID:38949", "EDB-ID:38954", "EDB-ID:38948", "EDB-ID:38947", "EDB-ID:38946"]}], "modified": "2021-04-22T23:44:04", "rev": 2}, "score": {"value": 7.5, "vector": "NONE", "modified": "2021-04-22T23:44:04", "rev": 2}}, "objectVersion": "1.5", "cpe": ["cpe:/a:doug_poulin:command_school_student_management_system:1.06.01"], "affectedSoftware": [{"cpeName": "doug_poulin:command_school_student_management_system", "name": "doug poulin command school student management system", "operator": "eq", "version": "1.06.01"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*"], "cwe": ["CWE-89"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html", "refsource": "MISC", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html"}, {"name": "101877", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101877"}, {"name": "64707", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/64707"}, {"name": "101884", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101884"}, {"name": "101874", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101874"}, {"name": "101879", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101879"}, {"name": "101880", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101880"}, {"name": "commandschool-id-sql-injection(90175)", "refsource": "XF", "tags": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90175"}, {"name": "101875", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101875"}, {"name": "101883", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101883"}, {"name": "101878", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101878"}, {"name": "101876", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101876"}, {"name": "101885", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101885"}, {"name": "101881", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101881"}, {"name": "101882", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/101882"}], "immutableFields": []}], "exploitdb": [{"id": "EDB-ID:38944", "hash": "342978a5b31ec334af16abd020a407a8ad5d26b83774909630cf47f4a2e43815", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_grades.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_grades.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38944/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:10:50", "history": [{"lastseen": "2016-02-04T09:10:50", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:10:50", "references": [], "description": "Command School Student Management System /sw/admin_grades.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:10:50", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:10:50"}}, "title": "Command School Student Management System /sw/admin_grades.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38944/", "id": "EDB-ID:38944", "viewCount": 6, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "e868055477f40341636ec566d136dfd4", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "9cba6c981b49711083550385ef2abb4b", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "3f9e3020b44496d63ee1b40edf6368d8", "key": "title"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "fbf03bf545e8a2855849c577db8d762a03974930614fcbb2565255f60536bde6"}}], "viewCount": 6, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:10:50", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:10:50", "rev": 2}, "exploitation": {"wildExploited": false, "wildExploitedSources": [], "modified": "2016-02-04T09:10:50"}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38944/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n\r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n\r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n\r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n\r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_grades.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101876"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "9cba6c981b49711083550385ef2abb4b"}, {"key": "href", "hash": "e868055477f40341636ec566d136dfd4"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "3f9e3020b44496d63ee1b40edf6368d8"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38945", "hash": "6173092469adc4325e1ecbd2fd2e46593fbc9a5572d89310b93011634db15c92", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_terms.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_terms.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38945/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:10:57", "history": [{"lastseen": "2016-02-04T09:10:57", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:10:57", "references": [], "description": "Command School Student Management System /sw/admin_terms.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:10:57", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:10:57"}}, "title": "Command School Student Management System /sw/admin_terms.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38945/", "id": "EDB-ID:38945", "viewCount": 8, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b674d45889f59d70aeae5138ab4e1a29", "key": "description"}, {"hash": "df256565780ad06d2751236a9881f080", "key": "title"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "3b62f3a024051eecf573a9fbf4d440f2", "key": "href"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "f5ae981165e3252683d49d0b1270109f8cb2989b80903e299de40a2bc67198f5"}}], "viewCount": 8, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:10:57", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:10:57", "rev": 2}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38945/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_terms.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101877"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "immutableFields": [], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "b674d45889f59d70aeae5138ab4e1a29"}, {"key": "href", "hash": "3b62f3a024051eecf573a9fbf4d440f2"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "df256565780ad06d2751236a9881f080"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38946", "hash": "5e813fee66a0314ed203b74bc34f2a8f1f56e23d12751bb00ab4501d6acdb60f", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_school_years.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_school_years.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38946/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:11:04", "history": [{"lastseen": "2016-02-04T09:11:04", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:11:04", "references": [], "description": "Command School Student Management System /sw/admin_school_years.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:11:04", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:04"}}, "title": "Command School Student Management System /sw/admin_school_years.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38946/", "id": "EDB-ID:38946", "viewCount": 10, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "fd4e341df563ae7becb10f1a99705ccf", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "7651686765bcb423e1e4e76a99cb2d7a", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "08febdafec85f358c0e0236417262b98", "key": "title"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "5c1eca03c1a613edc6b0ebb25d7bad37ab1ce6051ef0b2fc992b5fc040d01970"}}], "viewCount": 10, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:11:04", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:04", "rev": 2}, "exploitation": {"wildExploited": false, "wildExploitedSources": [], "modified": "2016-02-04T09:11:04"}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38946/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_school_years.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101878"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "7651686765bcb423e1e4e76a99cb2d7a"}, {"key": "href", "hash": "fd4e341df563ae7becb10f1a99705ccf"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "08febdafec85f358c0e0236417262b98"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38949", "hash": "fa099189e776ce63ef0ba1b37f4b37a7bf8ae63fd9e20cf82c4cc598857b1dc4", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_infraction_codes.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_infraction_codes.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38949/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:11:28", "history": [{"lastseen": "2016-02-04T09:11:28", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:11:28", "references": [], "description": "Command School Student Management System /sw/admin_infraction_codes.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:11:28", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:28"}}, "title": "Command School Student Management System /sw/admin_infraction_codes.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38949/", "id": "EDB-ID:38949", "viewCount": 6, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "fb2beb06e68a44ac25e37394f52f6b22", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "72337a905da63110b0d1c8ec89e51cbe", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "decf53b0454ea4d7d60c840dad06e586", "key": "title"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "c8581af8fcf99ed3d740e1e899050ccb39b86c21333914a4b6c47258482b6163"}}], "viewCount": 6, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:11:28", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:28", "rev": 2}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38949/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_infraction_codes.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101881"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "immutableFields": [], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "fb2beb06e68a44ac25e37394f52f6b22"}, {"key": "href", "hash": "72337a905da63110b0d1c8ec89e51cbe"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "decf53b0454ea4d7d60c840dad06e586"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38950", "hash": "29b476db56db1277819e23f77517fc81f75843b64b211f75ce50348087b2c253", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_generations.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_generations.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38950/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:11:36", "history": [{"lastseen": "2016-02-04T09:11:36", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:11:36", "references": [], "description": "Command School Student Management System /sw/admin_generations.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:11:36", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949"], "type": "exploitdb"}, {"idList": ["CVE-2014-1636"], "type": "cve"}], "modified": "2016-02-04T09:11:36"}}, "title": "Command School Student Management System /sw/admin_generations.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38950/", "id": "EDB-ID:38950", "viewCount": 6, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "3511ac2b54e8c6f085dc2e95bc367b07", "key": "title"}, {"hash": "f9d5fbf1947e782c0ff78160073b4e98", "key": "description"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "6b4b7069296c7dfa5a8037f30161046b", "key": "href"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "184c3a1047c24dd1a00606591cae573e582acc3310966c4db1bd683b592c1dc9"}}], "viewCount": 6, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:11:36", "rev": 2}, "dependencies": {"references": [{"idList": ["EDB-ID:38955", "EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949"], "type": "exploitdb"}, {"idList": ["CVE-2014-1636"], "type": "cve"}], "modified": "2016-02-04T09:11:36", "rev": 2}, "exploitation": {"wildExploited": false, "wildExploitedSources": [], "modified": "2016-02-04T09:11:36"}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38950/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_generations.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101882"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "f9d5fbf1947e782c0ff78160073b4e98"}, {"key": "href", "hash": "6b4b7069296c7dfa5a8037f30161046b"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "3511ac2b54e8c6f085dc2e95bc367b07"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38951", "hash": "9183cee4dd454e21e5719435b37eff01e1509c4a75a63cfb4f8c382161bfab05", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_relations.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_relations.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38951/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:11:43", "history": [{"lastseen": "2016-02-04T09:11:43", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:11:43", "references": [], "description": "Command School Student Management System /sw/admin_relations.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:11:43", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:43"}}, "title": "Command School Student Management System /sw/admin_relations.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38951/", "id": "EDB-ID:38951", "viewCount": 8, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "8918141f8b4e742287466d3afdacc701", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "cd9b5a1fbc783f19e09b24cf29ac9bab", "key": "title"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "5057beeffcee5824480b20bb29c4f34b", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "a8ed0f8a03b07e06cee914cb5f8772d0a4b7368c15d0546643088f6a832ac34c"}}], "viewCount": 8, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:11:43", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:43", "rev": 2}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38951/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_relations.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101883"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "immutableFields": [], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "5057beeffcee5824480b20bb29c4f34b"}, {"key": "href", "hash": "8918141f8b4e742287466d3afdacc701"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "cd9b5a1fbc783f19e09b24cf29ac9bab"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38952", "hash": "c0a4b692500b9b0190a9efe65e191c77ce41c826c3c6ee8e4f53c6c5f27bba15", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_titles.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_titles.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38952/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:11:51", "history": [{"lastseen": "2016-02-04T09:11:51", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:11:51", "references": [], "description": "Command School Student Management System /sw/admin_titles.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:11:51", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:51"}}, "title": "Command School Student Management System /sw/admin_titles.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38952/", "id": "EDB-ID:38952", "viewCount": 5, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "ff334f5816874c0ea009c9243b84b247", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "3ce5eb8d8d205c80005d618304a16556", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "f686b0ffa163a34d947b550b262ddc20", "key": "href"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "a1cd45708aa23a8e8b99f3eba8eec82bc022580b5b3e708ca35abdc0fea2636a"}}], "viewCount": 5, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:11:51", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:51", "rev": 2}, "exploitation": {"wildExploited": false, "wildExploitedSources": [], "modified": "2016-02-04T09:11:51"}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38952/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_titles.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101884"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "ff334f5816874c0ea009c9243b84b247"}, {"key": "href", "hash": "f686b0ffa163a34d947b550b262ddc20"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "3ce5eb8d8d205c80005d618304a16556"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38954", "hash": "0a85e158f68cc1ff893b4d0bf6b484dd39b2e5716cda8ef58d2a73105eb951ed", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_school_names.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_school_names.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38954/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:12:10", "history": [{"lastseen": "2016-02-04T09:12:10", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:12:10", "references": [], "description": "Command School Student Management System /sw/admin_school_names.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:12:10", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:12:10"}}, "title": "Command School Student Management System /sw/admin_school_names.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38954/", "id": "EDB-ID:38954", "viewCount": 10, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "59b90a225c5acd075028b1d504403413", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "f24bc282488c67cceeb2451cae8c6732", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "ea0304aac6155c001e93a96af31ddde9", "key": "description"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "55abc12ba62c36504d97ca61afa361a905e6baa25745c1bc217c9b39960a511b"}}], "viewCount": 10, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:12:10", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:12:10", "rev": 2}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38954/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_school_names.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101874"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "immutableFields": [], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "ea0304aac6155c001e93a96af31ddde9"}, {"key": "href", "hash": "f24bc282488c67cceeb2451cae8c6732"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "59b90a225c5acd075028b1d504403413"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38953", "hash": "db356ea1ce09c54049a2fe87a81830f1a68864692e1dc57e015c69b93216099a", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/health_allergies.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/health_allergies.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38953/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:12:00", "history": [{"lastseen": "2016-02-04T09:12:00", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:12:00", "references": [], "description": "Command School Student Management System /sw/health_allergies.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:12:00", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:12:00"}}, "title": "Command School Student Management System /sw/health_allergies.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38953/", "id": "EDB-ID:38953", "viewCount": 9, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "7c85f107cedef11a286c73d8c95c8d3a", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "99951ff925e7a094f451c06e138c37a7", "key": "description"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "23099ccac1991df88f301291b9871d57", "key": "href"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "465ed83aa68c2a44be0c051174515d17dea6127e34cdfb4d5aad1ff4bcc64ded"}}], "viewCount": 10, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:12:00", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38955", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:12:00", "rev": 2}, "exploitation": {"wildExploited": false, "wildExploitedSources": [], "modified": "2016-02-04T09:12:00"}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38953/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/health_allergies.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101885"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "99951ff925e7a094f451c06e138c37a7"}, {"key": "href", "hash": "23099ccac1991df88f301291b9871d57"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "7c85f107cedef11a286c73d8c95c8d3a"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38955", "hash": "0f79551e9be5cea883f6e755f1b6bf275bc7bf06772511b26d6f965299eb0dbf", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_subjects.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_subjects.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38955/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:12:20", "history": [{"lastseen": "2016-02-04T09:12:20", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:12:20", "references": [], "description": "Command School Student Management System /sw/admin_subjects.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:12:20", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:12:20"}}, "title": "Command School Student Management System /sw/admin_subjects.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38955/", "id": "EDB-ID:38955", "viewCount": 8, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "17e2b0f21d63b3b7f346926ad2b12832", "key": "description"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "74a19252bd478acb164668de22342846", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "5ad0b2f10a60de24cfa14a85bc075571", "key": "href"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "5ffb8d1d4a21241af7e7547660bb129847609197bf9553cddd33c6d05037d91c"}}], "viewCount": 9, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:12:20", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38951", "EDB-ID:38947", "EDB-ID:38944", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:12:20", "rev": 2}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38955/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_subjects.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101875"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "immutableFields": [], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "17e2b0f21d63b3b7f346926ad2b12832"}, {"key": "href", "hash": "5ad0b2f10a60de24cfa14a85bc075571"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "74a19252bd478acb164668de22342846"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}, {"id": "EDB-ID:38947", "hash": "ad97b41b81b1869c49bcf17f3f8bdc411c9ac2101cf7b218b9ae81b051e3e5c5", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Command School Student Management System /sw/admin_sgrades.php id Parameter SQL Injection", "description": "Command School Student Management System /sw/admin_sgrades.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "published": "2014-01-07T00:00:00", "modified": "2014-01-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/38947/", "reporter": "AtT4CKxT3rR0r1ST ", "references": [], "cvelist": ["CVE-2014-1636"], "lastseen": "2016-02-04T09:11:11", "history": [{"lastseen": "2016-02-04T09:11:11", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-04T09:11:11", "references": [], "description": "Command School Student Management System /sw/admin_sgrades.php id Parameter SQL Injection. CVE-2014-1636. Webapps exploit for php platform", "edition": 1, "cvss3": {}, "reporter": "AtT4CKxT3rR0r1ST ", "history": [], "published": "2014-01-07T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-04T09:11:11", "vector": "NONE", "value": 7.1}, "dependencies": {"rev": 2, "references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38951", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:11"}}, "title": "Command School Student Management System /sw/admin_sgrades.php id Parameter SQL Injection", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-1636"], "immutableFields": [], "modified": "2014-01-07T00:00:00", "href": "https://www.exploit-db.com/exploits/38947/", "id": "EDB-ID:38947", "viewCount": 6, "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hashmap": [{"hash": "5026d02f3b4df0dd1184bd9649cbe3ad", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "510771ff866303ca32a585663573945e", "key": "title"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "published"}, {"hash": "36a0070ab32d633f3e54f19d4ec45cc0", "key": "cvelist"}, {"hash": "06dd75a2d5a9bac0c3504869cf4f4234", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "cb4e12a5a1e930b1212b619cf4f1abbc", "key": "modified"}, {"hash": "b23cd74993097765ec6fbe1ccdb32e27", "key": "reporter"}], "hash": "a99c46a3e8edd9a14deb635f245e0e8e64d45668c4ee747a7a86843a078d3464"}}], "viewCount": 7, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2016-02-04T09:11:11", "rev": 2}, "dependencies": {"references": [{"idList": ["CVE-2014-1636"], "type": "cve"}, {"idList": ["EDB-ID:38951", "EDB-ID:38944", "EDB-ID:38945", "EDB-ID:38948", "EDB-ID:38946", "EDB-ID:38954", "EDB-ID:38953", "EDB-ID:38952", "EDB-ID:38949", "EDB-ID:38950"], "type": "exploitdb"}], "modified": "2016-02-04T09:11:11", "rev": 2}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/38947/", "sourceData": "source: http://www.securityfocus.com/bid/64707/info\r\n \r\nCommand School Student Management System is prone to the following security vulnerabilities:\r\n \r\n1. Multiple SQL-injection vulnerabilities\r\n2. A cross-site request forgery vulnerability\r\n3. A cross-site scripting vulnerability\r\n4. An HTML injection vulnerability\r\n5. A security-bypass vulnerability\r\n \r\nExploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.\r\n \r\nCommand School Student Management System 1.06.01 is vulnerable; other versions may also be affected. \r\n\r\nhttp://www.example.com/sw/admin_sgrades.php?action=edit&id=null+and+1=2+union+select+version()", "osvdbidlist": ["101879"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "immutableFields": [], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "36a0070ab32d633f3e54f19d4ec45cc0"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "5026d02f3b4df0dd1184bd9649cbe3ad"}, {"key": "href", "hash": "06dd75a2d5a9bac0c3504869cf4f4234"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "published", "hash": "cb4e12a5a1e930b1212b619cf4f1abbc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b23cd74993097765ec6fbe1ccdb32e27"}, {"key": "title", "hash": "510771ff866303ca32a585663573945e"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}]}
