vendor:
Simple Student Attendance System
by:
Gnanaraj Mauviel
6.1
CVSS
HIGH
Time Based Blind SQL Injection
89
CWE
Product Name: Simple Student Attendance System
Affected Version From: v1.0
Affected Version To: v1.0
Patch Exists: NO
Related CWE:
CPE: a:oretnom23:simple_student_attendance_system:1.0
Platforms Tested: Mac OSX, XAMPP, Apache, MySQL
2023
Simple Student Attendance System – Time Based Blind SQL Injection
The Simple Student Attendance System is vulnerable to a Time-Based Blind SQL Injection in the delete_student function of actions.class.php. An attacker can manipulate the 'id' parameter to execute malicious SQL queries, potentially leading to unauthorized data retrieval or modification. The vulnerability has been tested using sqlmap tool with a time-based blind technique.
Mitigation:
To mitigate this vulnerability, input validation and parameterized queries should be implemented to prevent SQL injection attacks. Regular security audits and code reviews are recommended to identify and address such vulnerabilities.
