CVE-2023-33439

HIGHNuclei

Faculty Evaluation System v1.0 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-33439 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 14, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryHIGHFaculty Evaluation System v1.0 - SQL InjectionCVSS 7.2

Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-89
AuthorsHarsh
Template tagscvecve2023sqlifacultyauthenticatedfaculty_evaluation_system_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:faculty_evaluation_system_project:faculty_evaluation_system:1.0:*:*:*:*:*:*:*
https://github.com/F14me7wq/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-1.md https://nvd.nist.gov/vuln/detail/CVE-2023-33439

Source: ProjectDiscovery

References

2