CVE-2024-28094: Blind SQL Injection in Chat functionality in Schoolbox

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-07 · updated 2026-06-17
Weakness: CWE-89

Description

Chat functionality in Schoolbox application before version 23.1.3 is vulnerable to blind SQL Injection enabling the authenticated attackers to read, modify, and delete database records.

Affected products

Schoolbox Pty Ltd Schoolbox: before 23.1.3 — fixed in 23.1.3

How to fix

Upgrade to a fixed version: Schoolbox Pty Ltd Schoolbox 23.1.3. Check the vendor advisory for mitigations.

References

https://schoolbox.education/
https://www.themissinglink.com.au/security-advisories/cve-2024-28094
https://schoolbox.education/
https://www.themissinglink.com.au/security-advisories/cve-2024-28094

Get alerted when CVE-2024-28094 or the next vulnerability affects your stack