High severity · published Oct 29, 2017
CVE-2017-15957
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file
8.8
CVSS
3.9%
EPSS
No
On KEV
Description
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Affected product
IS
Ingenious School Management System
Ingenious School Management System Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15957
Third Party Advisory
https://packetstormsecurity.com/files/144431/Ingenious-School-Management-System-2.3.0-Arbitrary-File-Upload.html
Exploit
https://www.exploit-db.com/exploits/43102/
More from Ingenious School Management System
9.8
CVE-2017-16561
/view/friend_profile.php in Ingenious School Management System 2.3.0 is vulnerable to Boolean-based and Time-based SQL injection in the 'friend_index' parameter of a GET request