SQL Injection Vulnerability in School Management System for WordPress

CVE-2024-12612

What is CVE-2024-12612?

The School Management System for WordPress plugin is susceptible to SQL Injection attacks through multiple AJAX action parameters. This vulnerability arises due to inadequate escaping of user-supplied input and a lack of proper handling in the SQL query formulation. Unauthenticated attackers can exploit this weakness to inject malicious SQL segments into existing queries, allowing them to retrieve sensitive information from the database. This poses serious risks for users relying on the plugin for secure data management.

References