SourceCodester Simple Student Attendance System student_form.php sql injection
CVE-2023-6657

9.8CRITICAL

Key Information:

Vendor
SourceCodester
Status
Simple Student Attendance System
Vendor
CVE Published:
10 December 2023

Summary

A SQL injection vulnerability exists in the SourceCodester Simple Student Attendance System 1.0, specifically in the file /modals/student_form.php. This issue arises from improper handling of the 'id' argument, allowing attackers to manipulate SQL queries executed by the application. As a result, unauthorized access to sensitive data and potential compromise of the database may occur. The vulnerability has been publicly disclosed, highlighting the urgency for users to implement preventive measures.

Affected Version(s)

Simple Student Attendance System 1.0

References

https://vuldb.com/?id.247365
vdb-entrytechnical-description
https://vuldb.com/?ctiid.247365
signaturepermissions-required
https://github.com/daydust/vuln/blob/main/Simple_Student_...
exploit

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daylightqc (VulDB User)
.