A vulnerability was found in code-projects Student Management System 1.0. It has been declared as critical. This vulnerability affects the function showSubject1 of the file /config/DbFunction.php. The manipulation of the argument sid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
References
| Link | Resource |
|---|---|
| https://code-projects.org/ | Product |
| https://gist.github.com/th4s1s/e8488d7e35d789581979f3b7e4c48b1f | Exploit |
| https://vuldb.com/?ctiid.290140 | Permissions Required |
| https://vuldb.com/?id.290140 | Third Party Advisory |
| https://vuldb.com/?submit.473410 | Third Party Advisory |
Configurations
History
22 Jan 2025, 15:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:code-projects:student_management_system:1.0:*:*:*:*:*:*:* | |
| First Time |
Code-projects student Management System
Code-projects |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | ||
| References | () https://code-projects.org/ - Product | |
| References | () https://vuldb.com/?id.290140 - Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.290140 - Permissions Required | |
| References | () https://gist.github.com/th4s1s/e8488d7e35d789581979f3b7e4c48b1f - Exploit | |
| References | () https://vuldb.com/?submit.473410 - Third Party Advisory |
04 Jan 2025, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-04 07:15
Updated : 2025-01-22 15:47
NVD link : CVE-2025-0203
Mitre link : CVE-2025-0203
JSON object : View
Products Affected
code-projects
- student_management_system
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')