Paper/Archive/CVE-2023-48720

CVE-2023-48720

Projectworlds Pvt. Limited Student Result Management System — Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 52.1.521 × 2010.4 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.

Affected

ProductAffectedFixed inSource

Student Result Management System1.0–CNA

Scores by source

Fluid Attacks (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

writeupfluidattacks.com/advisories/gilels refprojectworlds.in