Schools Alert Management Script SQL Injection Vulnerability (CNVD-2018-11296)

PHP Scripts Mall Schools Alert Management Script is a school management system script by PHP Scripts Mall India. A SQL injection vulnerability exists in several cgi's in PHP Scripts Mall Schools Alert Management Script. A remote attacker can exploit this vulnerability by sending specially crafted...

Schools Alert Management Script Absolute Path Traversal Vulnerability

Schools Alert Management Script is a set of school management system scripts. An absolute path traversal vulnerability exists in PHP Scripts Mall Schools Alert Management Script. The vulnerability can be exploited to read arbitrary files via the f parameter in img.php...

Schools Alert Management Script SQL Injection Vulnerability (CNVD-2018-11371)

PHP Scripts Mall Schools Alert Management Script is a school management system script by PHP Scripts Mall India. A SQL injection vulnerability exists in PHP Scripts Mall Schools Alert Management Script. A remote attacker can exploit this vulnerability by executing arbitrary SQL commands with the...

CVE-2018-12055

Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contactus.php, faq.php, about.php, photogallery.php, privacy.php, and so on...

Path traversal

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

CVE-2018-12054

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

CVE-2018-12052

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in getsec.php...

Remote code execution

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type...

Directory traversal

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in deleteimg.php by using directory traversal...

CVE-2018-12051

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type...

CVE-2018-12053

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in deleteimg.php by using directory traversal...

Sql injection

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in getsec.php...

CVE-2018-12053

CVE-2018-12053 affects the PHP Scripts Mall Schools Alert Management Script. Affected component: delete_img.php; vuln via the img parameter allowing directory traversal, enabling arbitrary file deletion. Public PoCs/exploits demonstrate accessing /delete_img.php?img=./uploads/school_logos/1528_x1...

CVE-2018-12052

CVE-2018-12052 affects the PHP Scripts Mall Schools Alert Management Script, with a SQL injection in the get_sec.php q parameter. The PoC shows an in-band attack using a UNION SELECT payload to leak data: /get_sec.php?q=1'+/!50000union /+select+1,/!50000concat /(user(),0x7e7e,database(),0x7e7e,@@...

CVE-2018-12052

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in getsec.php...

CVE-2018-12051

CVE-2018-12051 affects the PHP Scripts Mall Schools Alert Management Script. The vulnerability allows an attacker to upload arbitrary files and execute code remotely via the $_FILE handling in /webmasterst/general.php, demonstrated by a crafted .php file with an image/jpeg content type. Documente...

CVE-2018-12055

CVE-2018-12055 affects PHP Scripts Mall Schools Alert Management Script. The vulnerability is a SQL injection in multiple CGI endpoints (contact_us.php, faq.php, about.php, photo_gallery.php, privacy.php, etc.) triggered by crafted POST data, allowing an attacker to execute arbitrary SQL commands...

CVE-2018-12054

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

CVE-2018-12053

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in deleteimg.php by using directory traversal...

CVE-2018-11514

PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in editresumedet.php, as demonstrated by changing .docx to .php...