Description
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.
This issue affects Advance Web: all versions; Legacy Advance: all versions.
Ellucian CRM Advance is not impacted.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ellucian | Advance Web | — | — |
| Ellucian | Legacy Advance | — | — |
References
- https://labs.sra.io/posts/ellucian third-party-advisory