[CLOSE] OSVDB ID : 55554 - Disclosed: 2009-07-02

Description:

Zoph contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate upon submission to the 'people.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 54845 - Disclosed: 2009-06-02

Description:

Online Grades & Attendance contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the index.php script not properly sanitizing user input, specifically directory traversal style attacks (../../) supplied to the SKIN parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands which will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system.

[CLOSE] OSVDB ID : 54843 - Disclosed: 2009-06-01

Description:

Online Grades contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the parents/parents.php script not properly sanitizing user-supplied input to the ADD parameter (when the func parameter is set to mailto), and the cc parameter (when the func parameter is set to showteachermemo). This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 54844 - Disclosed: 2009-06-01

Description:

Online Grades contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the key parameter (when 'action' is set to 'resetpass'). This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 54846 - Disclosed: 2009-06-01

Description:

Online Grades & Attendance contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the admin/admin.php script not properly sanitizing user input, specifically directory traversal style attacks (../../) supplied to the skin parameter. This may allow an attacker with a valid Admin account to include a file from the targeted host that contains arbitrary commands which will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system.

[CLOSE] OSVDB ID : 54407 - Disclosed: 2009-05-12

Description:

BIGACE contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the New User Registration function not properly sanitizing user-supplied input to the 'username' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 54602 - Disclosed: 2009-05-07

Description:

myGesuad contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the common/login.php script not properly sanitizing user-supplied input to the formUser parameter. This may allow an attacker to bypass authentication.

[CLOSE] OSVDB ID : 54604 - Disclosed: 2009-05-07

Description:

myGesaud contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/kategorie.php script not properly sanitizing user-supplied input to the ID parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 54605 - Disclosed: 2009-05-07

Description:

myGesaud contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/budget.php script not properly sanitizing user-supplied input to the ID parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 54606 - Disclosed: 2009-05-07

Description:

myGesaud contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/zahlung.php script not properly sanitizing user-supplied input to the ID parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 54603 - Disclosed: 2009-05-07

Description:

myGesaud contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/adresse.php script not properly sanitizing user-supplied input to the ID parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.