CVE-2024-54922

A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, lastname, and username parameters.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2024-12-09

Last modified

2024-12-12

Weaknesses

CWE-89

Affected products

• E-learning Management System (Lopalopa)

References

• https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%2…