Gscsd

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

**Name of the Vulnerable Software and Affected Versions** sambitraj Student-Management-System versions prior to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 **Description** A remote attack can be launched against the `session start()` function, resulting in cookies being issued without the 'httponly' flag. The 'httponly' flag is a security measure that prevents client-side scripts from accessing the cookie, which helps mitigate the risk of session theft via cross-site scripting. **Recommendations** As a temporary workaround, consider restricting the use of the `session start()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be **Description** A remote code injection issue exists due to the improper handling of the `mathematical sentence` argument within the `eval()` function located in the application/pages/imba calculator/calculate.php file. **Recommendations** As a temporary workaround, restrict access to the `eval()` function in the application/pages/imba calculator/calculate.php file or avoid using the `mathematical sentence` argument until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be **Description** A remote SQL injection occurs due to the improper handling of the `Password` argument within the `Notes controller::accessing dictionary authorization()` function located in the application/PHP/objects/notes/accessing dictionary authorization.php file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** As a temporary workaround, consider restricting access to the `Notes controller::accessing dictionary authorization()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be **Description** An authorization bypass exists in the Note Handler/Assignment Handler component within the `/PHP/objects/notes` file. A remote attacker can trigger this issue by manipulating the `assignment item id` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** a4m4 Student-Management-System versions up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0 **Description** A flaw in the Admin Endpoint component, specifically within the `admin/` file, allows remote attackers to cause execution after redirect. This occurs through the manipulation of the `uid` argument across multiple endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.