CVE:CVE-2014-1915
CNNVD:CNNVD-201402-091
Command School Student Management System是一套基于Web的学生/学校管理系统。
Command School Student Management System 1.06.01版本中存在跨站请求伪造漏洞。远程攻击者可通过在sw/admin_change_password.php页面执行‘update’操作利用该漏洞更改管理员密码或向sw/add_topic.php页面添加标题和博客条目。
solution:Upgrade doug_poulin command_school_student_management_system to a higher version than 1.06.01,and avoid the version 1.06.01