Student-Management-System vulnerabilities

A cross-site scripting (XSS) vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The echo function in admin/fun/addLog.php does not neutralize the reason/detail arguments, allowing script injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf affects an unknown functionality of the file example_lite.sql. Manipulation can lead to the use of default credentials. The attack can be launched remotely and the exploit has been publicly disclosed.

A cross-site request forgery (CSRF) vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf affects an unknown function. The attack can be initiated remotely and the exploit is now public.

An authorization bypass vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Manipulation of the sid/addtime/type/reason/detail/logdate arguments in user/editLog.php leads to authorization bypass. The attack can be performed remotely and the exploit has been publicly disclosed.

A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fun/getStudent.php. This manipulation of the argument sid causes authorization bypass. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability in ningzichun Student Management System (up to a specific commit) affects the session_start function in login.php. The manipulation results in session fixation. The attack can be launched remotely, and the exploit is public. The product does not use versioning, so affected and unaffected release details are unavailable.

In ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf, a vulnerability was found in the mysqli_connect function of config/database.php in the Database Connection component. This manipulation causes hard-coded credentials. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The product uses a rolling release model, so specific version information is not available. The project was informed but has not responded.

A vulnerability in ningzichun Student Management System (up to a specific commit) affects an unknown function in the file example.7z of the Backup Handler component. The manipulation leads to information disclosure. The attack can be initiated remotely, and the exploit is public. The product uses continuous delivery with rolling releases, so no version details are available.

In sambitraj Student Management System up to version 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5, a flaw was found in the Password Handler component in file aca.sql. Manipulating the Password argument leads to cleartext storage of sensitive information. The attack can be executed remotely.

A use of default password vulnerability was found in sambitraj Student-Management-System up to commit 56ba287f. Remote exploitation is possible and the exploit is public. The project has not responded.

In sambitraj Student-Management-System up to version 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5, a vulnerability was detected in the session_start function that leads to cookies without the 'httponly' flag. The attack may be launched remotely but is difficult to exploit.

A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The vulnerability affects the function mysqli_query in the file student_dashboard.php of the component Student Dashboard. Manipulation of the argument roll_no results in improper authorization. The attack can be performed remotely. The exploit is public. The project has not responded yet.

A vulnerability was detected in sambitraj Student-Management-System. Unknown functionality of the Dashboard component allows manipulation of roll_no/teacher_name arguments, leading to SQL injection. The attack can be executed remotely, and the exploit is now public.

In the Student-Management-System (commit 18ea7904...), an SQL injection vulnerability was detected in loginCheckTest.php in the Login component. Manipulation of the username/password arguments allows remote attack. The exploit is public, and the product does not use versioning, so no information about affected versions is available.

A vulnerability in imranrisal-dev Student-Management-System allows unrestricted file upload via the storeProfileImage function in student_profile_pic.php. An attacker can remotely manipulate the choose_file argument to upload arbitrary files. The exploit has been publicly disclosed and may be utilized.

A weakness has been identified in imvks786 student_management_system up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46. An unknown function in the file /add.php of the Student Record Handler component is affected. Executing a manipulation can lead to improper access controls. The attack may be performed remotely. The exploit has been made public and could be used for attacks. The project uses a rolling release system, so version information is not disclosed. The project was informed but has not responded.

An improper authorization vulnerability was detected in Kushan2k student-management-system up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a in the edit-admin function of controllers/AdminController.php in the Profile Update Endpoint component via manipulation of the isadmin argument. The attack can be carried out remotely, and the exploit has been publicly disclosed. The product follows a rolling release model, so no version is provided.

Kushan2k student-management-system up to commit f16a4ce has an unrestricted file upload vulnerability in service/RegisterService.php via the stimg argument. The attack can be performed remotely, and the exploit is publicly available. The project has not responded.

Student-Management-System up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0 has a vulnerability in admin/deleteform.php where the sid argument leads to improper authorization.

Vulnerability in Student-Management-System (a4m4) up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0. An unknown function in admin/ allows execution after redirect (open redirect). Remote attack possible.

A cross-site scripting vulnerability was found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 on the Dashboard page. Manipulating the Name argument allows remote script execution. The exploit is public, and the project has not responded.

In sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0, an SQL injection vulnerability was found in the Login Page component. Manipulating the email argument leads to SQL injection. The attack can be performed remotely, and an exploit has been published. The project was informed early but has not responded.

Vulnerability in STUDENT-MANAGEMENT-SYSTEM (up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5) in the Dashboard component, leading to improper access controls. The attack can be performed remotely, and the exploit is publicly available.