Schools Alert Management Script version 2.0.2 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
5561cbf81e24d93f4a84037f9c7eb310######################################################################################
# Exploit Title: Schools Alert Management Script - 2.0.2 - Authentication Bypass
# Date: 07.02.2018
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/
# Category: Web Application
# Exploit Author: Prasenjit Kanti Paul
# Web: http://hack2rule.wordpress.com/
# Version: 2.0.2
# Tested on: Linux Mint
# CVE: CVE-2018-6859
#######################################################################################
Proof of Concept
=================
1. Go to login page
2. Choose Student/Parent/Management to login
2. put [admin' OR '1' = '1] as user and password field
3. You will be logged in as Student/Parent/Management