SourceCodester Simple Student Attendance System path traversal
CVE-2023-7058

9.8CRITICAL

Key Information:

Vendor
SourceCodester
Status
Simple Student Attendance System
Vendor
CVE Published:
22 December 2023

Summary

A path traversal vulnerability exists in SourceCodester Simple Student Attendance System 1.0, where improper handling of input parameters allows attackers to navigate outside the intended directories. Specifically, manipulation of the 'page' argument can lead to unauthorized access through the '../filedir' path. This issue can be exploited remotely, posing a significant security risk as attackers may gain access to sensitive files on the server. Public disclosure of this vulnerability raises concerns for users and requires immediate attention.

Affected Version(s)

Simple Student Attendance System 1.0

References

https://vuldb.com/?id.248749
vdb-entrytechnical-description
https://vuldb.com/?ctiid.248749
signaturepermissions-required
https://github.com/laoquanshi/Simple-Student-Attendance-S...
exploit

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

heishou (VulDB User)
.