Vulnerability · Published Sep 13, 2024 · Assigned by VulDB

CVE-2024-8784QDocs Smart School Management System Chat mynewuser sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in Smart School Management System from QDocs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.5%top 54.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknown functionality of the file /user/chat/mynewuser of the component Chat. The manipulation of the argument users[] with the input 1'+AND+(SELECT+3220+FROM+(SELECT(SLEEP(5)))ZNun)+AND+'WwBM'%3d'WwBM as part of POST Request Parameter leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.1 is able to address this issue. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
QDocs	Smart School Management System	7.0.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-277435 | QDocs Smart School Management System Chat mynewuser sql injection vdb-entry, technical-description
VDB-277435 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #407385 | QDocs QDocs Smart School Management System 7.0.0 SQL Injection third-party-advisory
https://github.com/bytium/vulnerability-research/blob/main/Advisory%20for%20Time-Based%20Blind%20SQL%20Injection%20in%20QDocs%20Smart%20School.md exploit
https://smart-school.in/article/version-7-0-1 patch
https://codecanyon.net/item/smart-school-school-management-system/19426018 patch