by Kastro
Paper/Archive/CVE-2023-3007

CVE-2023-3007

ningzichun Student Management System — ningzichun Student Management System Password Reset resetPassword.php password recovery

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.7.637 × 2012.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230354 is the identifier assigned to this vulnerability.

Affected

ProductAffectedFixed inSource
Student Management System1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
VulDB (CNA)6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

writeupvuldb.com/?id.230354refvuldb.com/?ctiid.230354exploitgithub.com/Xor-Gerke/webray.com.cn/blob/main/cve/student-management-system/password_reset.md