CVE-2023-5008 CRITICAL

CVE-2023-5008: Student Information System v1.0 - Unauthenticated SQL Injection

Vendor Kashipara Group

Product Student Information System

Weakness CWE-89 · SQLi

Published December 7, 2023

Last update October 9, 2024

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.

Key dates

02Disclosure timeline

December 7, 2023 CVE published

October 9, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-5008

Related vulnerabilities

04Related CVE

CVE-2024-9080 code-projects Student Record System pincode-verification.php sql injection CVE-2021-24758 Email Log < 2.4.7 - Admin+ SQL Injection CVE-2024-10612 ESAFENET CDG HookInvalidCourseService.java removeHookInvalidCourse sql injection CVE-2026-5587 wbbeyourself MAC-SQL Refiner Agent agents.py _execute_sql sql injection CVE-2023-50753 Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)