SQL Injection Vulnerability in School Activity Updates with SMS Notification by Janobe
CVE-2022-39976

9.8CRITICAL

Key Information:

Vendor: School Activity Updates With Sms Notification Project
Status: School Activity Updates With Sms Notification
Vendor: CVE Published:; 27 October 2022

🔔 Create School Activity Updates With Sms Notification Project Vulnerability Alert

What is CVE-2022-39976?

The School Activity Updates with SMS Notification version 1.0 is susceptible to a SQL injection vulnerability through the 'id' parameter in the URL. This flaw allows attackers to manipulate database queries, potentially accessing sensitive data and compromising the application’s integrity. It’s critical for users of this product to implement security measures to protect against such attacks.

References

https://github.com/z1pwn/bug_report/blob/main/vendors/jan...

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 27, 2022
Vulnerability Reserved
Sep 6, 2022

CVE-2022-39976 Data

JSON