SQL Injection Vulnerability in School Activity Updates with SMS Notification by Janobe
CVE-2022-38833

7.2HIGH

Key Information:

Vendor: School Activity Updates With Sms Notification Project
Status: School Activity Updates With Sms Notification
Vendor: CVE Published:; 16 September 2022

🔔 Create School Activity Updates With Sms Notification Project Vulnerability Alert

What is CVE-2022-38833?

The School Activity Updates with SMS Notification version 1.0 is susceptible to an SQL Injection vulnerability that can be exploited through maliciously crafted requests to the /activity/admin/modules/modstudent/index.php?view=view&id= endpoint. This flaw allows an attacker to manipulate SQL queries and potentially gain unauthorized access to the database, leading to information disclosure or further system compromise. Proper input validation and sanitation are necessary to mitigate this risk.

References

https://github.com/saluteSUC/bug_report/blob/main/vendors...

x_refsource_MISC

CVSS V3.1

Score:

7.2

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 16, 2022
Vulnerability Reserved
Aug 29, 2022

CVE-2022-38833 Data

JSON