CVE-2014-1637

Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2014-01-22

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Command School Student Management System (Doug Poulin)

References

• http://osvdb.org/101888
• http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html
• http://www.securityfocus.com/bid/64707