PT-2024-35202

CVE-2024-5236

Published

2024-05-22

Updated

2025-02-26

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Campcodes Complete Web-Based School Management System version 1.0

Description A critical issue was found in the file /view/teacher salary invoice1.php, where the manipulation of the date argument leads to SQL injection. The attack can be launched remotely.

Recommendations For Campcodes Complete Web-Based School Management System version 1.0, as a temporary workaround, consider restricting access to the /view/teacher salary invoice1.php file until a patch is available. Avoid using the date argument in the affected file to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Ssl_Seven_Security Lab_Wangzhiqiang_Xiaozilong

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2024-5236