High severity · published Dec 20, 2023
CVE-2023-5007
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Student Information System · Kashipara Group
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5007
Exploit
https://fluidattacks.com/advisories/kissin/
Not Applicable
https://www.kashipara.com/
More from Student Information System
9.8
CVE-2023-5008
Student Information System v1.0 - Unauthenticated SQL Injection
8.8
CVE-2023-5011
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
8.8
CVE-2023-5010
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
8.8
CVE-2023-4122
Student Information System v1.0 - Insecure File Upload