CVE-2021-42668

The CVE-2021-42668 entry concerns an SQL Injection in Sourcecodester Engineers Online Portal (PHP) via the id parameter in my_classmates.php. Affects the vulnerable page and parameter, enabling an attacker to extract sensitive data from the web server; in some cases it can lead to remote code exe...

CVE-2021-42669

CVE-2021-42669 is a PHP file-upload vulnerability in Sourcecodester Engineers Online Portal (via dashboard_teacher.php and avatar upload through teacher_avatar.php). An uploaded avatar is stored under /admin/uploads/ and is accessible to all users. Attackers can upload a PHP webshell containing ...

CVE-2021-42670

CVE-2021-42670 affects Sourcecodester Engineers Online Portal (PHP) with a SQL injection in the announcements_student.php id parameter. The vulnerability allows an attacker to manipulate SQL queries to extract data from the web server, with potential remote code execution in some scenarios as des...

CVE-2021-42671

CVE-2021-42671 (and related CVEs 42669) describe an unauthorized access/control flaw in Sourcecodester Engineers Online Portal (PHP) within nia_munoz_monitoring_system/admin/uploads. The issue enables bypassing access controls to view all files uploaded to the web server without authentication or...