SQL Injection Vulnerability in School Management System for WordPress Plugin

CVE-2024-12609

Summary

The School Management System for WordPress plugin is susceptible to SQL Injection through the 'view-attendance' page. In all versions up to and including 92.0.0, the vulnerability arises due to inadequate escaping of user-supplied parameters and poor handling of the SQL query in the mj_smgt_view_student_attendance() function. This flaw allows authenticated users, with at least Student-level access, to inject additional SQL queries, potentially enabling them to extract sensitive information stored in the database.

References