vendor:
Schools Alert Management System
by:
M3@Pandas
9.8
CVSS
CRITICAL
SQL Injection
89
CWE
Product Name: Schools Alert Management System
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: YES
Related CWE: CVE-2018-12052
CPE: a:phpscriptsmall:schools_alert_management_system
Metasploit:
N/A
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=12052, https://www.infosecmatter.com/nessus-plugin-library/?id=12205, https://www.infosecmatter.com/nessus-plugin-library/?id=12065, https://www.infosecmatter.com/nessus-plugin-library/?id=15963, https://www.infosecmatter.com/nessus-plugin-library/?id=15970, https://www.infosecmatter.com/nessus-plugin-library/?id=15456, https://www.infosecmatter.com/nessus-plugin-library/?id=15572, https://www.infosecmatter.com/nessus-plugin-library/?id=12209, https://www.infosecmatter.com/nessus-plugin-library/?id=12054, https://www.infosecmatter.com/nessus-plugin-library/?id=12055
Platforms Tested: Linux Mint
2018
Schools Alert Management Script – ‘get_sec.php’ SQL Injection
An SQL injection vulnerability exists in Schools Alert Management Script, which allows an attacker to execute arbitrary SQL commands via the 'get_sec.php' script. The vulnerability is due to insufficient sanitization of user-supplied input to the 'q' parameter. An attacker can exploit this vulnerability to gain access to sensitive information such as usernames, passwords, and other sensitive data stored in the database.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.
