Schools Alert Management Scripts Arbitrary File Read

Exploit Title: Schools Alert Management Script - Arbitrary File Read Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web Application Exploit Author: M3@Pandas Web:...

Schools Alert Management Script Absolute Path Traversal Vulnerability

Schools Alert Management Script is a set of school management system scripts. An absolute path traversal vulnerability exists in PHP Scripts Mall Schools Alert Management Script. The vulnerability can be exploited to read arbitrary files via the f parameter in img.php...

Schools Alert Management Script - Arbitrary File Deletion

Schools Alert Management Script - Arbitrary File Deletion Exploit Title: Schools Alert Management Script - Arbitrary File Deletion Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web...

Schools Alert Management Script - Arbitrary File Deletion Vulnerability

Exploit for php platform in category web applications Exploit Title: Schools Alert Management Script - Arbitrary File Deletion Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web Application Exploit...

Schools Alert Management Script - Arbitrary File Read

Schools Alert Management Script - Arbitrary File Read Exploit Title: Schools Alert Management Script - Arbitrary File Read Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web...

Schools Alert Management Script - Arbitrary File Deletion

Exploit Title: Schools Alert Management Script - Arbitrary File Deletion Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web Application Exploit Author: M3@Pandas Web:...

Schools Alert Management Script - Arbitrary File Read

Exploit Title: Schools Alert Management Script - Arbitrary File Read Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web Application Exploit Author: M3@Pandas Web:...

CVE-2018-12055

Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contactus.php, faq.php, about.php, photogallery.php, privacy.php, and so on...

CVE-2018-12054

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

CVE-2018-12052

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in getsec.php...

CVE-2018-12051

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type...

Directory traversal

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in deleteimg.php by using directory traversal...

Remote code execution

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type...

Sql injection

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in getsec.php...

CVE-2018-12053

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in deleteimg.php by using directory traversal...

CVE-2018-12052

CVE-2018-12052 affects the PHP Scripts Mall Schools Alert Management Script, with a SQL injection in the get_sec.php q parameter. The PoC shows an in-band attack using a UNION SELECT payload to leak data: /get_sec.php?q=1'+/!50000union /+select+1,/!50000concat /(user(),0x7e7e,database(),0x7e7e,@@...

CVE-2018-12053

CVE-2018-12053 affects the PHP Scripts Mall Schools Alert Management Script. Affected component: delete_img.php; vuln via the img parameter allowing directory traversal, enabling arbitrary file deletion. Public PoCs/exploits demonstrate accessing /delete_img.php?img=./uploads/school_logos/1528_x1...

CVE-2018-12055

Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contactus.php, faq.php, about.php, photogallery.php, privacy.php, and so on...

CVE-2018-12052

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in getsec.php...

CVE-2018-12054

Summary (CVE-2018-12054): The Schools Alert Management Script is vulnerable to an arbitrary file read via the f parameter in img.php (absolute path traversal). Exploitation PoC shows /img.php?f=/./etc/./passwd, enabling read of sensitive local files. Affected software: PHP Scripts Mall Schools Al...