CVE-2014-1636

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-01-22 · updated 2026-06-17
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.

Affected products

Doug Poulin Command School Student Management System: 1.06.01

References

http://osvdb.org/101874
http://osvdb.org/101875
http://osvdb.org/101876
http://osvdb.org/101877
http://osvdb.org/101878
http://osvdb.org/101879
http://osvdb.org/101880
http://osvdb.org/101881
http://osvdb.org/101882
http://osvdb.org/101883
http://osvdb.org/101884
http://osvdb.org/101885

Get alerted when CVE-2014-1636 or the next vulnerability affects your stack