Dredge School Administration System Multiple Security Vulnerabilities
BID:64720
Info
Dredge School Administration System Multiple Security Vulnerabilities
| Bugtraq ID: | 64720 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 07 2014 12:00AM |
| Updated: | Jan 07 2014 12:00AM |
| Credit: | AtT4CKxT3rR0r1ST |
| Vulnerable: |
chukwuma Dredge School Administration System 1.0 |
| Not Vulnerable: | |
Discussion
Dredge School Administration System Multiple Security Vulnerabilities
Dredge School Administration System is prone to the following security vulnerabilities:
1. An SQL-injection vulnerability
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An information-disclosure vulnerability
5. A security-bypass vulnerability
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, obtain sensitive information or bypass certain security restrictions to perform unauthorized actions.
Dredge School Administration System 1.0 is vulnerable; other versions may also be affected.
Dredge School Administration System is prone to the following security vulnerabilities:
1. An SQL-injection vulnerability
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An information-disclosure vulnerability
5. A security-bypass vulnerability
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, obtain sensitive information or bypass certain security restrictions to perform unauthorized actions.
Dredge School Administration System 1.0 is vulnerable; other versions may also be affected.
Exploit / POC
Dredge School Administration System Multiple Security Vulnerabilities
An attacker can exploit these issues through a browser. An attacker must trick an unsuspecting victim into following a malicious URI to exploit the cross-site scripting issues.
The following example URIs and inputs are available:
An attacker can exploit these issues through a browser. An attacker must trick an unsuspecting victim into following a malicious URI to exploit the cross-site scripting issues.
The following example URIs and inputs are available:
Solution / Fix
Dredge School Administration System Multiple Security Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Dredge School Administration System Multiple Security Vulnerabilities
References:
References:
- Dredge School Administration System Homepage (chukwuma)