PT-2020-15601 · Kabir Alhasan · Kabir Alhasan Student Management System

Name of the Vulnerable Software and Affected Versions: Kabir Alhasan Student Management System version 1.0 Description: The issue allows for Authentication Bypass. An attacker can exploit this by using a specific combination of username and password, such as 'admin', to bypass authentication...

SQL Injection Vulnerability in the Student Management System wjgl_xx.asp Page of Shanxi Huaxing TechSoft Co.

Student Management System is a software application for the daily management of various student information. A SQL injection vulnerability exists in the Student Management System developed by Shanxi Huaxing TechSoft Co. Ltd, which can be exploited by attackers to obtain sensitive information from...

某用户量较大的综合管理系统mssql注射漏洞

简要描述： 大量学生综合系统使用安脉的。 详细说明： 厂商： 上海安脉计算机科技有限公司 http://www.anmai.net/ SQL注射点： /oa/news/updateAffiche.aspx?id=1 其中id参数存在sql注射 互联网自动采集案例5枚： http://zhgl.w25z.cn/ANMAI/oa/news/updateAffiche.aspx?id=1 http://www.jukui.com/ANMAI/oa/news/updateAffiche.aspx?id=1...

CVE-2014-1914

Multiple cross-site scripting XSS vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the 1 topic parameter to sw/addtopic.php or 2 nick parameter to sw/chat/message.php...

CVE-2014-1915

Multiple cross-site request forgery CSRF vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of 1 administrators for requests that change the administrator password via an update action to sw/adminchangepassword.php or 2...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of 1 administrators for requests that change the administrator password via an update action to sw/adminchangepassword.php or 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the 1 topic parameter to sw/addtopic.php or 2 nick parameter to sw/chat/message.php...

CVE-2014-1915

Multiple cross-site request forgery CSRF vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of 1 administrators for requests that change the administrator password via an update action to sw/adminchangepassword.php or 2...

CVE-2014-1914

The CVE-2014-1914 entry describes multiple XSS vulnerabilities in the Command School Student Management System (version 1.06.01). The affected components are the web pages sw/add_topic.php (topic parameter) and sw/chat/message.php (nick parameter), where unsanitized input can be reflected to user...

CVE-2014-1915

CVE-2014-1915 affects Command School Student Management System 1.06.01 and involves Multiple CSRF vulnerabilities. The described flaws allow remote attackers to hijack admin authentication for password changes via sw/admin_change_password.php and to perform add_topic.php actions (adding a topic o...

CVE-2014-1914

Multiple cross-site scripting XSS vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the 1 topic parameter to sw/addtopic.php or 2 nick parameter to sw/chat/message.php...

CVE-2014-1637

Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backupray2.php, which allows remote attackers to download a database backup via a direct request...

CVE-2014-1636

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to 1 adminschoolnames.php, 2 adminsubjects.php, 3 admingrades.php, 4 adminterms.php, 5 adminschoolyears.php, 6...

Server side request forgery (ssrf)

Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backupray2.php, which allows remote attackers to download a database backup via a direct request...

Sql injection

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to 1 adminschoolnames.php, 2 adminsubjects.php, 3 admingrades.php, 4 adminterms.php, 5 adminschoolyears.php, 6...

CVE-2014-1636

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to 1 adminschoolnames.php, 2 adminsubjects.php, 3 admingrades.php, 4 adminterms.php, 5 adminschoolyears.php, 6...

CVE-2014-1637

CVE-2014-1637 affects Command School Student Management System 1.06.01. The issue is an improper access restriction on sw/backup/backup_ray2.php, allowing remote attackers to download a database backup via a direct request. Public exposure is indicated by referenced exploit information (Exploit-D...

CVE-2014-1636

CVE-2014-1636 describes multiple SQL injection vulnerabilities in the Command School Student Management System 1.06.01 . The flaw allows remote attackers to execute arbitrary SQL commands by manipulating the id parameter in an edit action across multiple admin pages (admin_school_names.php, admin...

CVE-2014-1637

Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backupray2.php, which allows remote attackers to download a database backup via a direct request...

Command School Student Management System - swadmin_grades.php?id SQL Injection

Command School Student Management System - swadmingrades.php?id SQL Injection source: https://www.securityfocus.com/bid/64707/info Command School Student Management System is prone to the following security vulnerabilities: 1. Multiple SQL-injection vulnerabilities 2. A cross-site request forgery...