CVE-2024-33403: SQL Injection
A SQL injection vulnerability in /model/getevents.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the eventid parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33403?
CVE-2024-33403 is classified as a critical SQL injection vulnerability that allows attackers to execute arbitrary SQL commands.
How do I fix CVE-2024-33403?
To fix CVE-2024-33403, validate and sanitize user inputs, particularly for the event_id parameter, and implement prepared statements in your SQL queries.
Which version of the Complete Web-Based School Management System is affected by CVE-2024-33403?
CVE-2024-33403 affects version 1.0 of the Complete Web-Based School Management System.
What kind of attacks can be executed through CVE-2024-33403?
CVE-2024-33403 allows attackers to perform SQL injection attacks, potentially leading to data leakage or database manipulation.
Where is the vulnerable code located in relation to CVE-2024-33403?
CVE-2024-33403 is found in /model/get_events.php, specifically where the event_id parameter is processed.