Paper/Archive/CVE-2023-5008

CVE-2023-5008

Kashipara Group Student Information System — Student Information System v1.0 - Unauthenticated SQL Injection

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 59.2.592 × 2011.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.

Affected

ProductAffectedFixed inSource

Student Information System1.0–CNA

Scores by source

Fluid Attacks (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupfluidattacks.com/advisories/blechacz refkashipara.com