SQL Injection Vulnerability in Web-Based School Management System
CVE-2024-34936
8.6HIGH
Summary
A SQL injection vulnerability has been identified in the 'view/event1.php' file of Campcodes' Complete Web-Based School Management System 1.0. This flaw allows attackers to manipulate the month parameter, potentially executing arbitrary SQL statements on the database. If exploited, the vulnerability may lead to unauthorized access to sensitive information, data corruption, or other malicious activities. Organizations using this software are encouraged to assess their security posture and implement necessary patches to mitigate associated risks.
References
CVSS V3.1
Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published