CVE-2014-1636
Command School Student Management System 1.06.01 - SQL Injection
Title source: llmExploitation Summary
EIP tracks 12 public exploits for CVE-2014-1636. PoCs published by AtT4CKxT3rR0r1ST.
AI-analyzed exploit summary The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload for version disclosure but lacks executable exploit code.
Description
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.
Exploits (12)
The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload for version disclosure but lacks executable exploit code.
The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload but lacks executable exploit code.
The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload but lacks functional exploit code.
The exploit demonstrates a SQL injection vulnerability in Command School Student Management System by injecting a UNION-based SQL query to retrieve the database version. The provided URL example shows how an attacker can manipulate the 'id' parameter to execute arbitrary SQL commands.
The exploit demonstrates a SQL injection vulnerability in Command School Student Management System by injecting a UNION-based payload to retrieve the database version. It is a straightforward example of exploiting improper input validation.
The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload but lacks executable exploit code.
The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload but lacks executable exploit code.
The exploit demonstrates a SQL injection vulnerability in Command School Student Management System by injecting a UNION-based SQL query to retrieve the database version. The PoC includes a crafted URL that exploits the vulnerability in the 'admin_relations.php' endpoint.
The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload but lacks executable exploit code.
The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload for version disclosure but lacks executable exploit code.
The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload for exploiting the vulnerability.
The provided text describes multiple vulnerabilities in Command School Student Management System, including SQL injection, CSRF, XSS, HTML injection, and security bypass. It includes a sample SQL injection payload but lacks executable exploit code.