PT-2019-19918
CVE-2019-9885
·
تاريخ النشر
2019-07-25
·
تاريخ التحديث
2019-10-09
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
eClass platform version ip.2.5.10.2.1
Description
The issue allows an attacker to execute SQL commands via the "/admin/academic/studenview left.php" API endpoint, specifically by manipulating the
StudentID parameter.Recommendations
For eClass platform version ip.2.5.10.2.1, consider restricting access to the "/admin/academic/studenview left.php" API endpoint to minimize the risk of exploitation. Avoid using the
StudentID parameter in this endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾