CVE-2014-1636 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 3.8% (pctl 90)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 3.8% — more likely to be exploited than 90% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2014-01-22 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| doug poulin | command school student management system |
Public exploits
References
- http://osvdb.org/101874
- http://osvdb.org/101875
- http://osvdb.org/101876
- http://osvdb.org/101877
- http://osvdb.org/101878
- http://osvdb.org/101879
- http://osvdb.org/101880
- http://osvdb.org/101881
- http://osvdb.org/101882
- http://osvdb.org/101883
- http://osvdb.org/101884
- http://osvdb.org/101885
- http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html
- http://www.securityfocus.com/bid/64707
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90175
- http://osvdb.org/101874
- http://osvdb.org/101875
- http://osvdb.org/101876
- http://osvdb.org/101877
- http://osvdb.org/101878
→ the Explorer · watch your stack · NVD