CVE-2014-1636

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/101882
http://osvdb.org/101877
http://osvdb.org/101884
http://osvdb.org/101875
http://osvdb.org/101883
http://osvdb.org/101874
http://osvdb.org/101876
http://osvdb.org/101879
http://osvdb.org/101880
http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html	Exploit
http://osvdb.org/101878
http://osvdb.org/101881
http://osvdb.org/101885
http://www.securityfocus.com/bid/64707
https://exchange.xforce.ibmcloud.com/vulnerabilities/90175

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*

Information

Published : 2014-01-22 11:55

Updated : 2018-10-30 09:26

NVD link : CVE-2014-1636

Mitre link : CVE-2014-1636

JSON object : View

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Advertisement

Products Affected

doug_poulin

command_school_student_management_system

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://osvdb.org/101882", "name": "101882", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101877", "name": "101877", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101884", "name": "101884", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101875", "name": "101875", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101883", "name": "101883", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101874", "name": "101874", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101876", "name": "101876", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101879", "name": "101879", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101880", "name": "101880", "tags": [], "refsource": "OSVDB"}, {"url": "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html", "name": "http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://osvdb.org/101878", "name": "101878", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101881", "name": "101881", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/101885", "name": "101885", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.securityfocus.com/bid/64707", "name": "64707", "tags": [], "refsource": "BID"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90175", "name": "commandschool-id-sql-injection(90175)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-89"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-1636", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-01-22T19:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:doug_poulin:command_school_student_management_system:1.06.01:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-30T16:26Z"}