Schools Alert Management Script version 2.0.2 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
666d800ac5246d4a537bb9b76689a2facf3b7ec48c51e13335170e839e6f33df
######################################################################################
# Exploit Title: Schools Alert Management Script - 2.0.2 - Authentication Bypass
# Date: 07.02.2018
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/
# Category: Web Application
# Exploit Author: Prasenjit Kanti Paul
# Web: http://hack2rule.wordpress.com/
# Version: 2.0.2
# Tested on: Linux Mint
# CVE: CVE-2018-6859
#######################################################################################
Proof of Concept
=================
1. Go to login page
2. Choose Student/Parent/Management to login
2. put [admin' OR '1' = '1] as user and password field
3. You will be logged in as Student/Parent/Management