CVE-2024-5232

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. This affects an unknown part of the file /view/teacher_salary_details2.php. The manipulation of the argument index leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265983.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Campcodes	Complete Web-Based School Management System	1.0
campcodes	complete_web-based_school_management_system	1.0

References

https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2022.pdfExploit
https://vuldb.com/?ctiid.265983Permissions Required, VDB Entry
https://vuldb.com/?id.265983Permissions Required, VDB Entry
https://vuldb.com/?submit.339808Third Party Advisory, VDB Entry
https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2022.pdfExploit
https://vuldb.com/?ctiid.265983Permissions Required, VDB Entry
https://vuldb.com/?id.265983Permissions Required, VDB Entry
https://vuldb.com/?submit.339808Third Party Advisory, VDB Entry

Timeline

Published: May 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-523209.8The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request CVE-2024-523215.9Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files con CVE-2024-523225.5WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure,CVE-2024-523238.1Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to r CVE-2024-523249.8Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send CVE-2024-523259.6ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.CVE-2024-523276.5The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the CVE-2024-523282.3ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /da CVE-2024-523297.4ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modif CVE-2024-52336.5A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. This vulnerability CVE-2024-523307.4ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possib CVE-2024-523317.5ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malic