CVE-2022-2707: SourceCodester Online Class and Exam Scheduling System faculty_sched.php sql injection
First published: Mon Aug 08 2022(Updated: )
A vulnerability classified as critical was found in SourceCodester Online Class and Exam Scheduling System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/faculty_sched.php. The manipulation of the argument faculty with the input ' OR (SELECT 2078 FROM(SELECT COUNT(*),CONCAT(0x716a717071,(SELECT (ELT(2078=2078,1))),0x717a706a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- uYCM leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205831.
Credit: cna@vuldb.com cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Online Class And Exam Scheduling System | =1.0 | |
| Online Class And Exam Scheduling System | =1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-2707?
CVE-2022-2707 is classified as a critical vulnerability.
How does CVE-2022-2707 affect the Online Class and Exam Scheduling System?
CVE-2022-2707 allows for SQL injection through the manipulation of the 'faculty' argument in the file /pages/faculty_sched.php.
What versions of the Online Class and Exam Scheduling System are affected by CVE-2022-2707?
Only version 1.0 of the Online Class and Exam Scheduling System is affected by CVE-2022-2707.
How do I fix CVE-2022-2707?
To fix CVE-2022-2707, you should sanitize and validate all user inputs, specifically in the 'faculty' argument.
What type of vulnerability is CVE-2022-2707?
CVE-2022-2707 is an SQL injection vulnerability that can lead to unauthorized access to the database.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/severity
- agent/first-publish-date
- agent/description
- agent/event
- agent/last-modified-date
- agent/author
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/fabian
- canonical/online class and exam scheduling system
- version/online class and exam scheduling system/1.0
- vendor/online class and exam scheduling system project