Description (CNA)
The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / School Management System | affected 0 before 2.2.5 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.