Schools Alert Management Script - Arbitrary File Read

Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. id: CVE-2018-12054 info: name: Schools Alert Management Script - Arbitrary File Read author: wisnupramoedya severity: high description: Schools Alert...

Schools Alert Management Script - Arbitrary File Read Detection

Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f paramet...

EUVD-2018-18606

Malware in sbrugna...

Schools Alert Management Script SQL Injection

Exploit Title: Schools Alert Management Script - SQL Injection Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web Application Exploit Author: M3@Pandas Web:...

Schools Alert Management Script - Arbitrary File Deletion Vulnerability

Exploit for php platform in category web applications Exploit Title: Schools Alert Management Script - Arbitrary File Deletion Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web Application Exploit...

Sql injection

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in getsec.php...

Directory traversal

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in deleteimg.php by using directory traversal...

CVE-2018-12051

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type...

CVE-2018-12054

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

CVE-2018-12055

CVE-2018-12055 affects PHP Scripts Mall Schools Alert Management Script. The vulnerability is a SQL injection in multiple CGI endpoints (contact_us.php, faq.php, about.php, photo_gallery.php, privacy.php, etc.) triggered by crafted POST data, allowing an attacker to execute arbitrary SQL commands...

CVE-2018-12051: Unrestricted Upload of File with Dangerous Type

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type...

CVE-2018-12052: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in getsec.php...

CVE-2018-12055: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contactus.php, faq.php, about.php, photogallery.php, privacy.php, and so on...

CVE-2018-12053: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in deleteimg.php by using directory traversal...

CVE-2018-12054: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

PT-2018-10976

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script affected versions not specified Description The issue concerns SQL Injections in PHP Scripts Mall Schools Alert Management Script. Specifically, the vulnerability exists via crafted POST data in...

PT-2018-10974

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script affected versions not specified Description The issue allows for Arbitrary File Deletion via the img parameter in the "delete img.php" endpoint by utilizing directory traversal. Recommendations...

PT-2018-10975

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script affected versions not specified Description The issue allows for Arbitrary File Read via the f parameter in the "img.php" endpoint. This is achieved through absolute path traversal, enabling...

PT-2018-10973

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script affected versions not specified Description The issue exists due to SQL Injection in the PHP Scripts Mall Schools Alert Management Script. Specifically, the vulnerability is exploitable via the ...

PT-2018-10972

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script affected versions not specified Description The issue concerns Arbitrary File Upload and Remote Code Execution in PHP Scripts Mall Schools Alert Management Script. This is achieved through the $...