Cross site request forgery (csrf)

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

Design/Logic Flaw

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18793

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18794

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

CVE-2018-18795

CVE-2018-18795 corresponds to a SQL Injection vulnerability in School Event Management System 1.0. The flaw is triggered via the id parameter in the pages student/index.php and event/index.php, allowing an attacker to manipulate the backend database. Connected sources corroborate the same descrip...

CVE-2018-18794

The CVE-2018-18794 entry corresponds to a Cross-Site Request Forgery (CSRF) vulnerability in School Event Management System 1.0. Public documents detail CSRF via user/controller.php?action=edit and related admin-update flows. Exploitation evidence shows abuse of session state (checking ACCOUNT_ID...

CVE-2018-18793

CVE-2018-18793 affects School Event Management System 1.0. The vulnerability is an Arbitrary File Upload through the endpoint event/controller.php?action=photos, enabling uploading of arbitrary files via the photos handler. Public exploits and shell-upload references exist (Exploit-DB, PacketStor...

CVE-2018-18793: Unrestricted Upload of File with Dangerous Type

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

PT-2018-14657

Name of the Vulnerable Software and Affected Versions School Event Management System version 1.0 Description The issue allows for Arbitrary File Upload. This can be achieved via the "event/controller.php?action=photos" endpoint, specifically by exploiting the action parameter set to photos...

PT-2018-14659

Name of the Vulnerable Software and Affected Versions School Event Management System version 1.0 Description The issue is related to SQL Injection, which can be exploited via the id parameter in the "student/index.php" or "event/index.php" API endpoints. Recommendations For School Event Managemen...

PT-2018-14658

Name of the Vulnerable Software and Affected Versions School Event Management System version 1.0 Description The issue allows for CSRF via the "user/controller.php?action=edit" endpoint, potentially enabling unauthorized modifications. Recommendations For School Event Management System version 1....

CVE-2018-18794: Cross-Site Request Forgery (CSRF)

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

CVE-2018-18795: Improper Neutralization of Special Elements used in an SQL Command

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

School Event Management System 1.0 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: School Event Management System 1.0 - Cross-Site Request Forgery Update Admin Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

School Event Management System 1.0 Cross Site Request Forgery

Exploit Title: School Event Management System 1.0 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

School Event Management System 1.0 SQL Injection

Exploit Title: School Event Management System 1.0 - SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/sems1.zip Version: 1.0 Category:...

School Event Management System 1.0 - Arbitrary File Upload

School Event Management System 1.0 - Arbitrary File Upload Exploit Title: School Event Management System 1.0 - Arbitrary File Upload Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

School Event Management System 1.0 - SQL Injection

Exploit Title: School Event Management System 1.0 - SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/sems1.zip Version: 1.0 Category:...

Security Bulletin: IBM Cloud Event Management is affected by a security vulnerability when using Microsoft Internet Explorer (CVE-2018-1365)

Summary IBM Cloud Event Management is affected by one or more security vulnerabilities. When using Internet Explorer, Cloud Event Management can be loaded in to an iframe that is not part of the Cloud Event Management system. If you do not load Cloud Event Management directly, your session might ...