The School Management Education Learning Erp
Monthly
SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.