CVE-2024-8784

Name of the Vulnerable Software and Affected Versions: QDocs Smart School Management System version 7.0.0

Description: A critical vulnerability was found in the QDocs Smart School Management System. The issue affects an unknown functionality of the file /user/chat/mynewuser of the component Chat. The manipulation of the argument users[] with a specific input as part of a POST request parameter leads to SQL injection. The attack can be launched remotely.

Recommendations: For QDocs Smart School Management System version 7.0.0, upgrade to version 7.0.1 to address this issue. As a temporary workaround, consider restricting access to the vulnerable Chat component until the upgrade is applied. Avoid using the users[] argument in the affected API endpoint until the issue is resolved.