Information disclosure in Doug Poulin Command School Student Management System
CVE-2014-1637
Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request.
Vulnerability class: Information Disclosure
EPSS: 0.069 (93.4th percentile) — read the EPSS interpretation.
Affected products
- Doug_poulin Command_school_student_management_system — versions 1.06.01
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_MISC)