CVE-2014-1636

N/A Unknown

Published: January 22, 2014 Modified: April 29, 2026

Description

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://osvdb.org/101874

Source: cve@mitre.org

http://osvdb.org/101875

Source: cve@mitre.org

http://osvdb.org/101876

Source: cve@mitre.org

http://osvdb.org/101877

Source: cve@mitre.org

http://osvdb.org/101878

Source: cve@mitre.org

http://osvdb.org/101879

Source: cve@mitre.org

http://osvdb.org/101880

Source: cve@mitre.org

http://osvdb.org/101881

Source: cve@mitre.org

http://osvdb.org/101882

Source: cve@mitre.org

http://osvdb.org/101883

Source: cve@mitre.org

http://osvdb.org/101884

Source: cve@mitre.org

http://osvdb.org/101885

Source: cve@mitre.org

http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/bid/64707

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/90175

Source: cve@mitre.org

http://osvdb.org/101874