Critical severity · published Dec 7, 2023
CVE-2023-5008
Student Information System v1.0 - Unauthenticated SQL Injection
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Student Information System · Kashipara Group
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5008
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5008
Exploit
https://fluidattacks.com/advisories/blechacz/
Product
https://www.kashipara.com/
More from Student Information System
8.8
CVE-2023-5007
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
8.8
CVE-2023-5011
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
8.8
CVE-2023-5010
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
8.8
CVE-2023-4122
Student Information System v1.0 - Insecure File Upload