A vulnerability was found in Xianqi Kindergarten Management System 2.0 Bulid 20190808. It has been rated as critical. This issue affects some unknown processing of the file stu_list.php of the component Child Management. The manipulation of the argument sex leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
References
| Link | Resource |
|---|---|
| https://github.com/Upgradeextension/xianqi/blob/main/README.md | Exploit |
| https://github.com/Upgradeextension/xianqi/blob/main/README.md | Exploit |
| https://vuldb.com/?ctiid.304973 | Permissions Required VDB Entry |
| https://vuldb.com/?id.304973 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.553239 | Third Party Advisory VDB Entry |
Configurations
History
24 Apr 2025, 12:58
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:xianqi:kindergarten_management_system:2.0:*:*:*:*:*:*:* | |
| First Time |
Xianqi
Xianqi kindergarten Management System |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-89 | |
| References | () https://vuldb.com/?id.304973 - Third Party Advisory, VDB Entry | |
| References | () https://github.com/Upgradeextension/xianqi/blob/main/README.md - Exploit | |
| References | () https://vuldb.com/?submit.553239 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?ctiid.304973 - Permissions Required, VDB Entry |
16 Apr 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-74 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
16 Apr 2025, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-16 11:15
Updated : 2025-04-24 12:58
NVD link : CVE-2025-3684
Mitre link : CVE-2025-3684
JSON object : View
Products Affected
xianqi
- kindergarten_management_system
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')