CVE-2023-5011

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5011
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://fluidattacks.com/advisories/kissin/ Exploit Third Party Advisory
https://www.kashipara.com/ Not Applicable
https://fluidattacks.com/advisories/kissin/ Exploit Third Party Advisory
https://www.kashipara.com/ Not Applicable
Configurations

Configuration 1 (hide)

cpe:2.3:a:kashipara:student_information_system:1.0:*:*:*:*:wordpress:*:*
History

19 May 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 8.8
Summary (en) Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database. (en) Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

21 Nov 2024, 08:40

Type Values Removed Values Added
References () https://fluidattacks.com/advisories/kissin/ - Exploit, Third Party Advisory () https://fluidattacks.com/advisories/kissin/ - Exploit, Third Party Advisory
References () https://www.kashipara.com/ - Not Applicable () https://www.kashipara.com/ - Not Applicable

26 Dec 2023, 21:32

Type Values Removed Values Added
References () https://fluidattacks.com/advisories/kissin/ - () https://fluidattacks.com/advisories/kissin/ - Exploit, Third Party Advisory
References () https://www.kashipara.com/ - () https://www.kashipara.com/ - Not Applicable
First Time Kashipara student Information System
Kashipara
Summary
  • (es) Student Information System v1.0 es afectado por múltiples vulnerabilidades de inyección SQL autenticada. El parámetro 'coursename' del recurso marks.php no valida los caracteres recibidos y se envían sin filtrar a la base de datos.
CPE cpe:2.3:a:kashipara:student_information_system:1.0:*:*:*:*:wordpress:*:*

20 Dec 2023, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-20 16:15

Updated : 2025-05-19 19:15

NVD link : CVE-2023-5011

Mitre link : CVE-2023-5011

CVE.ORG link : CVE-2023-5011

JSON object : View

Products Affected

kashipara

  • student_information_system
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')