PT-2022-19722
CVE-2022-29603
·
تاريخ النشر
2022-04-25
·
تاريخ التحديث
2022-05-04
الوصف من
CVSS 3.1
8.1
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
UniverSIS-API versions through 1.2.1
Description
A SQL Injection issue exists, allowing a remote authenticated attacker to send crafted SQL statements to vulnerable API endpoints, such as
/api/students/me/messages/, via the select parameter. This could potentially lead to the retrieval of personal information or modification of grades.Recommendations
For UniverSIS-API versions through 1.2.1, consider restricting access to the vulnerable API endpoints, such as
/api/students/me/messages/, until a fix is available. As a temporary workaround, avoid using the select parameter in affected API endpoints to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾