Cak Filemanagement System
Monthly
Unrestricted file upload in Cak Filemanagement System allows a remote attacker to write an attacker-controlled file to the server through the File argument in admin/add_logs.php. The published CVSS 4.0 vector scores 6.9 with network/low-complexity conditions and no stated privilege or interaction requirement, but Low impact metrics; the independent assessment instead applies CVSS 3.1 with PR:L and High confidentiality, integrity, and availability impact, and notes that the admin/ endpoint likely requires administrative access although enforcement is unconfirmed. A public PoC reference exists but is not verified as working exploit code, and no CISA KEV status is provided, so confirmed active exploitation is not established.
SQL injection in the admin student-save handler (admin/save_student.php) of the open-source 37954679 cak-filemanagement-system allows remote attackers to inject arbitrary SQL through the date, department, subject, forwarded_to, action_taken_by, section, or password parameters that are passed into a mysqli_query call. The project is affected through commit 5e6433246475e66462e1fea980688de96a049297 and the vendor has not responded to the issue report, so no fixed release is identified. Impact is scored Medium (CVSS 4.0 base 6.9 with E:P; independent CVSS 3.1 6.9, C:L/I:L/A:L); a public PoC reference exists in the upstream issue tracker but it is not verified as working exploit code, and there is no evidence of active exploitation. The main open question is the authentication requirement: the supplied vector asserts PR:N while the vulnerable script sits under an admin/ path, and a login gate would materially reduce exploitability.
Unrestricted file upload in Cak Filemanagement System allows a remote attacker to write an attacker-controlled file to the server through the File argument in admin/add_logs.php. The published CVSS 4.0 vector scores 6.9 with network/low-complexity conditions and no stated privilege or interaction requirement, but Low impact metrics; the independent assessment instead applies CVSS 3.1 with PR:L and High confidentiality, integrity, and availability impact, and notes that the admin/ endpoint likely requires administrative access although enforcement is unconfirmed. A public PoC reference exists but is not verified as working exploit code, and no CISA KEV status is provided, so confirmed active exploitation is not established.
SQL injection in the admin student-save handler (admin/save_student.php) of the open-source 37954679 cak-filemanagement-system allows remote attackers to inject arbitrary SQL through the date, department, subject, forwarded_to, action_taken_by, section, or password parameters that are passed into a mysqli_query call. The project is affected through commit 5e6433246475e66462e1fea980688de96a049297 and the vendor has not responded to the issue report, so no fixed release is identified. Impact is scored Medium (CVSS 4.0 base 6.9 with E:P; independent CVSS 3.1 6.9, C:L/I:L/A:L); a public PoC reference exists in the upstream issue tracker but it is not verified as working exploit code, and there is no evidence of active exploitation. The main open question is the authentication requirement: the supplied vector asserts PR:N while the vulnerable script sits under an admin/ path, and a login gate would materially reduce exploitability.