CVE-2020-14972 - Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (RCE) via the user_email, user_pass, and id parameters on the admin login-portal and the edit-lessons webpages

Back Back to CVE browser

CRITICAL

Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (RCE) via the user_email, user_pass, and id parameters on the admin login-portal and the edit-lessons webpages

Published Jun 22, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 6.02%

Description

Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (RCE) via the user_email, user_pass, and id parameters on the admin login-portal and the edit-lessons webpages.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7102
Advisory
https://www.exploit-db.com/exploits/48439
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://www.sourcecodester.com
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7102		Advisory
https://www.exploit-db.com/exploits/48439		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://www.sourcecodester.com		x_refsource_MISCVendor Advisory