vendor:
Enrollment System
by:
Gnanaraj Mauviel
6.1
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Enrollment System
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: CVE-2023-XXXX
CPE: a:obi08:enrollment_system:1.0
Platforms Tested: Mac OSX, XAMPP, Apache, MySQL
2023
Enrollment System v1.0 – SQL Injection
The exploit allows an attacker to perform SQL injection in the Enrollment System v1.0 application by manipulating the 'emc' parameter in the '/get_subject.php' URI. By injecting a crafted payload, an attacker can retrieve sensitive information from the database. This vulnerability has a CVE identifier.
Mitigation:
To mitigate the SQL injection vulnerability, input validation and parameterized queries should be implemented in the application code to prevent malicious input manipulation.