Ssl_Seven_Security_Lab_Wangzhiqiang_Zhanxiuchen

**Name of the Vulnerable Software and Affected Versions** code-projects Internship Management System version 1.0 **Description** An issue exists in the Employer Login Endpoint within the file `employer/login.php`. The manipulation of the `email` and `password` arguments allows for SQL injection, which is a technique used to interfere with the queries that an application makes to its database. This flaw enables remote exploitation. **Recommendations** Restrict access to the `employer/login.php` file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Online Examination version 1.0 **Description** An issue exists in the Quiz Creation Feature within the file `/update.php?q=addquiz`. Remote attackers can perform SQL injection, a technique used to manipulate database queries, by manipulating the `name`, `total`, `right`, `wrong`, `time`, `tag`, or `desc` arguments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Online Examination version 1.0 **Description** An issue exists in the `head.php` file where manipulating the `uname` and `password` arguments can lead to SQL injection, a technique used to interfere with the queries that an application makes to its database. This flaw allows for remote exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Internship Management System version 1.0 **Description** An issue exists in the Password Change Endpoint within the file `employer/details/change password.php`. A remote attacker can perform a SQL injection by manipulating the `Current` argument. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update code-projects Internship Management System version 1.0 to a version that contains a fix for this issue. As a temporary mitigation, restrict access to the `employer/details/change password.php` file.

**Name of the Vulnerable Software and Affected Versions** code-projects Assessment Management version 1.0 **Description** A remote cross-site scripting issue exists in the `admin/view-users.php` file. This occurs when the `User` argument is manipulated, allowing an attacker to execute malicious scripts in the context of the user's session. **Recommendations** As a temporary workaround, restrict access to the `admin/view-users.php` file or avoid using the `User` argument until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Assessment Management version 1.0 **Description** An issue exists in the `/lecturer/marking-scheme.php` file where improper handling of the `smarksrange[]` variable allows for remote SQL injection. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to manipulate or access the database. **Recommendations** As a temporary workaround, restrict access to the `/lecturer/marking-scheme.php` file or avoid using the `smarksrange[]` parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Assessment Management version 1.0 **Description** An SQL injection flaw exists in the Database Query Handler component due to improper processing of the `/lecturer/marking-scheme.php` endpoint. A remote attacker can exploit this by manipulating the `squestions[]` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Assessment Management version 1.0 **Description** Cross site scripting occurs due to the manipulation of the `ID` argument within the '/admin/remove-user.php' endpoint. This issue allows a remote attacker to execute malicious scripts in the context of the user's session. **Recommendations** Update code-projects Assessment Management to a version newer than 1.0. As a temporary mitigation, restrict access to the '/admin/remove-user.php' file.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A SQL injection issue exists in the `/process/applyleaveprocess.php` file. This occurs when the `ID` argument is manipulated, allowing a remote attacker to execute unauthorized database queries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A remote cross-site scripting issue exists in the `/applyleave.php` file. This occurs when the `ID` argument is manipulated, allowing an attacker to execute malicious scripts in the victim's browser. **Recommendations** Restrict access to the `/applyleave.php` file or avoid using the `ID` parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A weakness in the file '/eloginwel.php' allows for remote cross-site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites. This occurs through the manipulation of the `ID` argument. **Recommendations** As a temporary workaround, restrict access to the '/eloginwel.php' file or avoid using the `ID` argument within this endpoint until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A remote cross-site scripting issue exists in the '/myprofile.php' file. Manipulation of the `ID` argument allows an attacker to execute malicious scripts in the victim's browser. **Recommendations** As a temporary workaround, restrict access to the '/myprofile.php' file or avoid using the `ID` parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A remote cross-site scripting issue exists in the `/myprofileup.php` file. This occurs when the `ID` argument is manipulated, allowing an attacker to execute malicious scripts in the victim's browser. **Recommendations** As a temporary workaround, restrict access to the `/myprofileup.php` file or avoid using the `ID` parameter within that endpoint until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A flaw in the `/changepassemp.php` endpoint allows for remote cross-site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites. This occurs through the manipulation of the `ID` argument. **Recommendations** As a temporary workaround, restrict access to the `/changepassemp.php` file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** Remote cross-site scripting (XSS) is possible through the manipulation of the `ID` argument within the '/empproject.php' endpoint. Cross-site scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Restrict access to the '/empproject.php' file or avoid using the `ID` parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Employee Management System version 1.0 **Description** A SQL injection issue exists in the `/changepassemp.php` file. This allows a remote attacker to manipulate queries via an unknown function within that file. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** As a temporary workaround, restrict access to the `/changepassemp.php` file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A security flaw allows remote attackers to perform SQL injection, which is a technique where malicious SQL statements are inserted into entry fields for execution. The issue exists in an unknown function within the '/psubmit.php' endpoint via the manipulation of the `pid` variable. **Recommendations** As a temporary workaround, restrict access to the '/psubmit.php' endpoint or avoid using the `pid` parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** Cross site scripting (XSS) can be initiated remotely via the manipulation of the `ID` argument within the '370project/edit.php' file. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A remote SQL injection exists in the file '370project/cancel.php'. The issue occurs when the `id/token` argument is manipulated, allowing an attacker to execute arbitrary SQL commands. **Recommendations** As a temporary workaround, restrict access to the '370project/cancel.php' file or avoid using the `id/token` argument until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A remote SQL injection can occur due to a weakness in an unknown function within the '370project/approve.php' file. This issue is triggered by manipulating the `id`/`token` argument. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or manipulation of the database. **Recommendations** As a temporary workaround, restrict access to the '370project/approve.php' file or avoid using the `id` and `token` arguments until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.