Student Crud Operation
Monthly
Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump `/card_activation.sql` from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists per the referenced GitHub writeup, though no CISA KEV listing is present.
Time-based blind SQL injection in code-projects Student Crud Operation 1.0 allows low-privileged remote attackers to extract database contents by manipulating the `id` parameter in `/edit.php`. A public proof-of-concept exploit documenting the exact technique has been published on GitHub, making exploitation straightforward with automated tooling. No vendor patch has been identified, and the product shows no evidence of active maintenance.
Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump `/card_activation.sql` from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists per the referenced GitHub writeup, though no CISA KEV listing is present.
Time-based blind SQL injection in code-projects Student Crud Operation 1.0 allows low-privileged remote attackers to extract database contents by manipulating the `id` parameter in `/edit.php`. A public proof-of-concept exploit documenting the exact technique has been published on GitHub, making exploitation straightforward with automated tooling. No vendor patch has been identified, and the product shows no evidence of active maintenance.