Gxcy.Org.Cn

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view department.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Computer Repair Shop Management System versions prior to 1.0 **Description** Remote SQL injection is possible via the manipulation of the `ID` argument within an unknown function of the '/admin/products/manage product.php' endpoint. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update to a version newer than 1.0. As a temporary mitigation, restrict access to the '/admin/products/manage product.php' endpoint.