SQL Injection vulnerability in oretnom23 School Faculty Scheduling System version 1.0, allows remote attacker to execute arbitrary code, escalate privilieges, and gain sensitive information via crafted payload to id parameter in manage_user.php.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/TCSWT/School-Faculty-Scheduling-System - Exploit, Third Party Advisory | |
| References | () https://www.sourcecodester.com/download-code?nid=14535&title=School+Faculty+Scheduling+System+using+PHP%2FMySQLi+with+Source+Code - Product | |
| References | () https://www.sourcecodester.com/php/14535/school-faculty-scheduling-system-using-phpmysqli-source-code.html - Product |
17 Aug 2023, 01:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.sourcecodester.com/php/14535/school-faculty-scheduling-system-using-phpmysqli-source-code.html - Product | |
| References | (MISC) https://github.com/TCSWT/School-Faculty-Scheduling-System - Exploit, Third Party Advisory | |
| References | (MISC) https://www.sourcecodester.com/download-code?nid=14535&title=School+Faculty+Scheduling+System+using+PHP%2FMySQLi+with+Source+Code - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:school_faculty_scheduling_system_project:school_faculty_scheduling_system:1.0:*:*:*:*:*:*:* | |
| CWE | CWE-89 |
11 Aug 2023, 15:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-11 14:15
Updated : 2024-11-21 05:28
NVD link : CVE-2020-36034
Mitre link : CVE-2020-36034
CVE.ORG link : CVE-2020-36034
JSON object : View
Products Affected
school_faculty_scheduling_system_project
- school_faculty_scheduling_system
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')