CVE-2024-33404: SQL Injection

Published May 6, 2024

Updated

A SQL injection vulnerability in /model/addstudentfirstpayment.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the index parameter.

Affected Software

2 affected components

Campcodes School Management Software

Campcodes School Management Software=1.0

Event History

May 6, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-33404?

The CVE-2024-33404 vulnerability has a high severity rating due to its potential for allowing SQL injection attacks.

How do I fix CVE-2024-33404?

To fix CVE-2024-33404, sanitize and validate input parameters in the '/model/add_student_first_payment.php' script to prevent SQL injection.

What systems are affected by CVE-2024-33404?

CVE-2024-33404 affects Campcodes Complete Web-Based School Management System version 1.0.

Can CVE-2024-33404 lead to data theft?

Yes, CVE-2024-33404 can lead to data theft as an attacker may execute arbitrary SQL commands to access sensitive data.

How can I prevent CVE-2024-33404?

To prevent CVE-2024-33404, implement prepared statements and parameterized queries in the database interactions.