CVE-2023-5011

HIGH

Student Information System 1.0 - Authenticated SQL Injection via coursename Parameter

Title source: llm
STIX 2.1

Description

Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

References (2)

Core 2
Core References
Exploit, Third Party Advisory third-party-advisory
https://fluidattacks.com/advisories/kissin/
Not Applicable product
https://www.kashipara.com/

Scores

CVSS v3 8.8
EPSS 0.0067
EPSS Percentile 47.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
kashipara/student_information_system 1.0
Published Dec 20, 2023
Tracked Since Feb 18, 2026