CVE-2024-4824

Name of the Vulnerable Software and Affected Versions School ERP Pro+Responsive version 1.0

Description The issue allows SQL injection through the "/SchoolERP/office admin/" index in parameters such as groups id, examname, classes id, es voucherid, es class, etc. This could enable a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the database.

Recommendations For School ERP Pro+Responsive version 1.0, as a temporary workaround, consider restricting access to the vulnerable parameters groups id, examname, classes id, es voucherid, es class, etc. in the "/SchoolERP/office admin/" index until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.