CVE-2019-18344

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Sourcecodester Online Grading System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the student, instructor, department, room, class, or user page (id or classid parameter).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.sevenlayers.com/index.php/262-online-grading-system-1-0-sqliExploit, Third Party Advisory
https://www.sevenlayers.com/index.php/262-online-grading-system-1-0-sqliExploit, Third Party Advisory

Timeline

Published: Oct 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-183459.3A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker CVE-2019-183468.8A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send CVE-2019-183475.4A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unpr CVE-2019-183486.1An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the at CVE-2019-183499.8HotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp.CVE-2019-18354.4A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an authenticated, local attacker to access sensitive information CVE-2019-183506.1In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of CVE-2019-183528.2Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using CVE-2019-183559.8An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.CVE-2019-183566.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).CVE-2019-183576.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).CVE-2019-183595.5A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads