Online Course Registration Site
Monthly
SQL injection in code-projects Online Course Registration 1.0 allows high-privileged remote attackers to manipulate the coursecode parameter in /admin/edit-course.php, potentially extracting or modifying database contents. CVSS 4.0 reflects limited scope (only confidentiality/integrity impact to database layer with no system scope expansion), but the vulnerability requires administrative authentication (PR:H), significantly constraining real-world risk despite public exploit availability and 0.03% EPSS indicating minimal spontaneous exploitation likelihood.
SQL injection in code-projects Online Course Registration 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter in /admin/manage-students.php. The CVSS 4.0 vector specifies PR:N, indicating no authentication is required despite the admin-path location - consistent with typical access-control weaknesses in this class of small PHP academic projects. A public proof-of-concept exploit has been published, though EPSS remains low at 0.03% (8th percentile), suggesting limited observed exploitation activity at time of analysis.
SQL injection in code-projects Online Course Registration 1.0 allows high-privileged remote attackers to manipulate the coursecode parameter in /admin/edit-course.php, potentially extracting or modifying database contents. CVSS 4.0 reflects limited scope (only confidentiality/integrity impact to database layer with no system scope expansion), but the vulnerability requires administrative authentication (PR:H), significantly constraining real-world risk despite public exploit availability and 0.03% EPSS indicating minimal spontaneous exploitation likelihood.
SQL injection in code-projects Online Course Registration 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter in /admin/manage-students.php. The CVSS 4.0 vector specifies PR:N, indicating no authentication is required despite the admin-path location - consistent with typical access-control weaknesses in this class of small PHP academic projects. A public proof-of-concept exploit has been published, though EPSS remains low at 0.03% (8th percentile), suggesting limited observed exploitation activity at time of analysis.