CVE-2023-4776 - WPSchoolPress < 2.2.5 - Teacher+ SQLi

Back Back to CVE browser

HIGH

WPSchoolPress < 2.2.5 - Teacher+ SQLi

Published Oct 16, 2023

8.8

HIGH

CVSS 3.1

EPSS 0.72%

Description

The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.

Affected products

Vendor n/a Product School Management System Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.2.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

School Management System

unaffected

Version	Status	Constraints
0	affected	<2.2.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54622
Advisory
https://wpscan.com/vulnerability/59dd3917-01cb-479f-a557-021b2a5147df
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54622		Advisory
https://wpscan.com/vulnerability/59dd3917-01cb-479f-a557-021b2a5147df		exploitvdb-entrytechnical-descriptionThird Party Advisory