vendor:
Alumni Tracer SMS Notification
by:
Ihsan Sencan
8.8
CVSS
HIGH
SQL Injection / Cross-Site Request Forgery
89,352
CWE
Product Name: Alumni Tracer SMS Notification
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sourcecodester:alumni_tracer_sms_notification_using_phpmysqli
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: WiN7_x64/KaLiLinuX_x64
2018
Alumni Tracer SMS Notification – SQL Injection / Cross-Site Request Forgery (Add/Update Admin)
Alumni Tracer SMS Notification is vulnerable to SQL Injection and Cross-Site Request Forgery. An attacker can inject malicious SQL queries into the vulnerable parameters and can also add/update admin credentials by exploiting the Cross-Site Request Forgery vulnerability.
Mitigation:
Input validation should be done to prevent SQL Injection and Cross-Site Request Forgery attacks. Access control should be implemented to restrict unauthorized access.
