CVE-2009-2037

Online Grades & Attendance v3.2.5 and earlier (potentially 3.2.6) are affected by multiple local file include/directory traversal vulnerabilities. The issue stems from insufficient input sanitization in two parameters: GLOBALS[SKIN] in index.php and skin in admin/admin.php, enabling remote attack...

CVE-2009-0479

The CVE-2009-0479 entry concerns Online Grades 3.2.4, specifically the admin/admin_login.php component, where the (1) uname and (2) pword parameters are susceptible to SQL injection. Remote attackers could execute arbitrary SQL commands via these inputs, indicating a classic backend query manipul...

CVE-2009-0453

CVE-2009-0453 affects Online Grades 3.2.4. The vulnerability allows remote attackers to disclose configuration information by requesting phpinfo.php, which invokes phpinfo(). The root cause is exposure of PHP configuration via the phpinfo output. Documented impact is information disclosure (parti...

CVE-2009-0452

The CVE-2009-0452 entry covers multiple SQL injection flaws in Online Grades 3.2.4, specifically in parents/login.php, when magic_quotes_gpc is disabled. The vulnerability allows remote attackers to inject SQL via the (1) uname or (2) pass parameters. This is caused by insufficient input validati...

CVE-2009-2598

CVE-2009-2598 affects Online Grades & Attendance 3.2.6 and earlier. The vulnerability stems from multiple SQL injection flaws: (1) via the key parameter in a resetpass action to index.php (remote unauthenticated access) and (2) via the ADD parameter in a mailto action to parents/parents.php (remo...