CVE-2021-3262
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A vulnerability in TripSpark VEO Transportation and NovusEDU allows SQL injection through unsanitized POST parameters. Attackers can manipulate student busing information search queries.
Risk Assessment
The risk includes unauthorized access, modification, or deletion of student data, potentially compromising privacy and system integrity.
Recommendation
Immediately update the software to the latest version and implement server-side input validation and sanitization.
Original NVD description (English source)
TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users without sanitizing using server-side logic. It was possible to inject custom SQL commands into the "Student Busing Information" search queries.