CVE-2022-1287CWE-99

School Club Application System resource injection

Medium · published April 9, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=save_user. The manipulation with a POST request leads to privilege escalation. The attack can be initiated remotely and does not require authentication. The exploit has been disclosed to the public and may be used.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00736 · 53.9th percentile
Weakness
CWE-99 · Improper Control of Resource Identifiers ('Resource Injection')
Published
2022-04-09T20:10Z
EPSS history
Timeline
  • 09 APR 20:10Z
    School Club Application System resource injection
    cvelistv5