SQL Injection in Pearson Esis Enterprise Student Information System

CVE-2014-1455

SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and earlier, allows remote attackers to execute arbitrary SQL commands via the new password.

Vulnerability class: SQL Injection

EPSS: 0.014 (68.7th percentile) — read the EPSS interpretation.

Affected products

Pearson Esis_enterprise_student_information_system
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)