vendor:
Teachers Record Management System
by:
nhattruong
9
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Teachers Record Management System
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:phpgurukul:teachers_record_management_system
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 10 + XAMPP v3.2.4
2021
Teachers Record Management System 1.0 – Multiple SQL Injection (Authenticated)
Teachers Record Management System 1.0 is vulnerable to multiple authenticated SQL Injection attacks. An attacker can exploit this vulnerability by sending malicious payloads to the application. The payloads can be sent via POST request to the search.php page or via GET request to the edit-subjects-detail.php and edit-teacher-detail.php pages. The payloads can be used to bypass authentication and gain access to the application.
Mitigation:
Input validation should be used to prevent SQL Injection attacks. All user input should be validated and filtered before being used in SQL queries.
