PT-2021-24089
CVE-2021-44427
·
تاريخ النشر
2021-11-29
·
تاريخ التحديث
2021-12-02
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
Name of the Vulnerable Software and Affected Versions:
Rosario Student Information System versions prior to 8.1.1
Description:
The issue allows remote attackers to execute PostgreSQL statements, such as SELECT, INSERT, UPDATE, and DELETE, through the /Side.php endpoint via the
syear parameter. This enables unauthorized access to database operations.Recommendations:
For versions prior to 8.1.1, update to version 8.1.1 or later to resolve the issue.
As a temporary workaround, consider restricting access to the /Side.php endpoint to minimize the risk of exploitation.
Avoid using the
syear parameter in the affected endpoint until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾