Project Worlds Student Project Allocation System SQL注入漏洞

2024-10-29 Project Worlds PoC No

Description

Project Worlds Student Project Allocation System是Project Worlds公司的一个学生项目分配系统。 Project Worlds Student Project Allocation System 1.0版本存在SQL注入漏洞，该漏洞源于Project Selection Page组件的/student/project_selection/remove_project.php页面中的no参数包含一个SQL注入漏洞。

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

https://{'title': 'CVE-2024-10425', 'description': 'A vulnerability was found in Project Worlds Student Project Allocation System 1.0. It has been classified as critical. This affects an unknown part of the file /student/project_selection/move_up_project.php of the component Project Selection Page. The manipulation of the argument up leads to sql injection. This vulnerability is uniquely identified as CVE-2024-10425.', 'published': '2024-10-27', 'source': 'VulDB, cvedetails.com, NVD'}
https://{'title': 'CVE-2024-10424', 'description': 'A vulnerability has been found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /student/project_selection/remove_project.php of the component Project Selection Page. The manipulation of the argument no leads to sql injection. The attack can be launched remotely.', 'published': '2024-10-27', 'source': 'VulDB, cvedetails.com, NVD'}
https://{'title': 'CVE-2024-10423', 'description': 'A vulnerability, which was classified as critical, was found in Project Worlds Student Project Allocation System 1.0. Affected is an unknown function of the file /student/project_selection/project_selection.php of the component Project Selection Page. The manipulation of the argument project_id leads to sql injection. It is possible to launch the attack remotely.', 'published': '2024-10-27', 'source': 'VulDB, cvedetails.com, NVD'}
https://{'title': 'CVE-2025-4482', 'description': 'A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0. Affected by this vulnerability is an unknown functionality of the file /change_pass/forgot_password_sql.php. The manipulation of the argument Pat_BloodGroup1 leads to sql injection. The attack can be launched remotely.', 'published': '2025-05-09', 'source': 'NVD, VulDB'}
https://{'title': 'CVE-2025-4837', 'description': 'A vulnerability classified as critical has been found in projectworlds Student Project Allocation System 1.0. This affects an unknown part of the file /make_group_sql.php. The manipulation of the argument mem1/mem2/mem3 leads to sql injection. It is possible to initiate the attack remotely.', 'published': '2025-05-17', 'source': 'cve.yack.one, NVD'}

Description

PoC

References

Related Vulnerabilities