Description

SQL Injection vulnerability in oretnom23 School Faculty Scheduling System version 1.0, allows remote attacker to execute arbitrary code, escalate privilieges, and gain sensitive information via crafted payload to id parameter in manage_user.php.

Related CPE's

a

school_faculty_scheduling_system_project

school_faculty_scheduling_system

1.0

Vulnerable

References

https://github.com/TCSWT/School-Faculty-Scheduling-System

ExploitThird Party Advisory

https://www.sourcecodester.com/download-code?nid=14535&title=School+Faculty+Scheduling+System+using+PHP%2FMySQLi+with+Source+Code

Product

https://www.sourcecodester.com/php/14535/school-faculty-scheduling-system-using-phpmysqli-source-code.html

Product

https://github.com/TCSWT/School-Faculty-Scheduling-System

ExploitThird Party Advisory

https://www.sourcecodester.com/download-code?nid=14535&title=School+Faculty+Scheduling+System+using+PHP%2FMySQLi+with+Source+Code

Product

https://www.sourcecodester.com/php/14535/school-faculty-scheduling-system-using-phpmysqli-source-code.html

Product

Weaknesses

[email protected]

Primary
CWE-89

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2023-08-11T12:15:11.643Z

2 years ago

Last modified

2024-11-21T04:28:41.260Z

1 year ago