CVE-2020-36034: SQL Injection

Published Aug 11, 2023

Updated

SQL Injection vulnerability in oretnom23 School Faculty Scheduling System version 1.0, allows remote attacker to execute arbitrary code, escalate privilieges, and gain sensitive information via crafted payload to id parameter in manageuser.php.

Affected Software

1 affected component

School Faculty Scheduling System Project School Faculty Scheduling System=1.0

Event History

Aug 11, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2020-36034?

CVE-2020-36034 is considered a critical severity vulnerability due to its potential for remote code execution and privilege escalation.

How do I fix CVE-2020-36034?

To fix CVE-2020-36034, validate and sanitize all user inputs, especially the 'id' parameter in manage_user.php, to prevent SQL injection.

What types of systems are affected by CVE-2020-36034?

CVE-2020-36034 affects the School Faculty Scheduling System version 1.0.

What kind of attacks can be executed using CVE-2020-36034?

An attacker can exploit CVE-2020-36034 to execute arbitrary SQL commands, leading to unauthorized data access and privilege escalation.

Is there a patch available for CVE-2020-36034?

Currently, there is no official patch available for CVE-2020-36034, so immediate remediation through coding practices is necessary.