CVE-2023-5007

HIGH

Student Information System 1.0 - Authenticated SQL Injection via marks.php id Parameter

Title source: llm

Description

Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

References (2)

Core 2

Core References

Not Applicable product

https://www.kashipara.com/

Exploit, Third Party Advisory third-party-advisory

https://fluidattacks.com/advisories/kissin/

Scores

CVSS v3 8.8

EPSS 0.0067

EPSS Percentile 47.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

kashipara/student_information_system 1.0

Published Dec 20, 2023

Tracked Since Feb 18, 2026