CVE-2023-5008

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5008

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

S

tudent Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.

References
Link Resource
https://fluidattacks.com/advisories/blechacz/ Exploit Third Party Advisory
https://www.kashipara.com/ Product
https://fluidattacks.com/advisories/blechacz/ Exploit Third Party Advisory
https://www.kashipara.com/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:imsurajghosh:student_information_system:1.0:*:*:*:*:*:*:*
History

21 Nov 2024, 08:40

Type Values Removed Values Added
References () https://fluidattacks.com/advisories/blechacz/ - Exploit, Third Party Advisory () https://fluidattacks.com/advisories/blechacz/ - Exploit, Third Party Advisory
References () https://www.kashipara.com/ - Product () https://www.kashipara.com/ - Product
Information

Published : 2023-12-08 00:15

Updated : 2024-11-21 08:40

NVD link : CVE-2023-5008

Mitre link : CVE-2023-5008

CVE.ORG link : CVE-2023-5008

JSON object : View

Products Affected

imsurajghosh

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')