CVE-2024-4824

Description

Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, classes_id, es_voucherid, es_class, etc. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the database.

Reserved 2024-05-13 | Published 2024-05-13 | Updated 2024-08-01 | Assigner INCIBE

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

1.0
affected

Credits

Rafael Pedrero finder

References

www.incibe.es/...ties-school-erp-proresponsive-arox-solution

cve.org (CVE-2024-4824)

nvd.nist.gov (CVE-2024-4824)

Download JSON