SQL Injection in Obi08/enrollment System
CVE-2024-58276
Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames and passwords.
Vulnerability class: SQL Injection
EPSS: 0.004 (29.1th percentile) — read the EPSS interpretation.
Affected products
- Obi08/enrollment System — versions 1.0
Weakness classification (CWE)
References
- ExploitDB-51845 (exploit)
- Official Product Homepage (product)
- disclosure@vulncheck.com (third-party-advisory)