CVE-2024-33911
Weblizar School Management Pro SQL injection
Improper neutralisation of special elements in an SQL command in School Management Pro.
Technical summary
School Management Pro is a commercial WordPress plugin for school administration. A parameter handled by the plugin reaches an SQL statement without being neutralised, so an authenticated user can extend the query the plugin intended to run.
The published CVSS vectors put the privileges required at high, meaning the issue is reachable from a privileged account rather than anonymously. Patchstack scores the scope as changed, which is why its 7.6 differs from NVD’s 7.2.
Impact
Unauthorised read access to the plugin’s database tables, and through them to the wider WordPress database that holds pupil, staff and user records.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar School Management Pro. This issue affects School Management Pro: from n/a through 10.3.4.
Published severity
| Published by | Version | Base score | Vector |
|---|---|---|---|
| Patchstack (CNA) | CVSS 3.1 | 7.6 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L |
| NVD | CVSS 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
More than one organisation has scored this issue. We reproduce every published score and vector as published, attributed to its source, and do not compute our own.
References
Credit
Researcher: Ivan Spiridonov
Credited in the CVE record as “Ivan Spiridonov (Patchstack Alliance)”.
This is the work we do commercially
Vulnerability research and penetration testing by the same engineers who found this issue. Every report carries reproduction steps, impact and a retest.
Vulnerability researchPenetration testingGet the sample report
We publish advisories, not exploits. Each entry describes the vulnerability class and impact at the level the vendor advisory does, and links to the authoritative records. Where public proof-of-concept code exists we link to it rather than reproduce it.
How we disclose
Every issue here was reported to the vendor or to a coordinating programme before publication. We publish only once a fix is available or the coordinated disclosure window has elapsed.
Want this kind of scrutiny on your own software?
Tell us what you want to protect. A senior tester will help you agree the scope and next steps. We usually reply within one business day.
Confidential from the first conversation
We can sign your NDA before you share sensitive details. Your enquiry is covered by our privacy policy.
How we protect your information · Privacy policy