CVE-2023-5008

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Kashipara Group	Student Information System	1.0

References

https://fluidattacks.com/advisories/blechacz/Exploit, Third Party Advisory
https://www.kashipara.com/Product
https://fluidattacks.com/advisories/blechacz/Exploit, Third Party Advisory
https://www.kashipara.com/Product

Timeline

Published: Dec 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-500827.5Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via sessio CVE-2023-500899.8A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution o CVE-2023-50099.8An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 1 CVE-2023-500909.8Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and r CVE-2023-500926.1APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS).CVE-2023-500936.1APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection.CVE-2023-500948.8reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/to CVE-2023-500967.5STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to t CVE-2023-50108.8Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the mar CVE-2023-501005.4JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.CVE-2023-501015.4JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.CVE-2023-501025.4JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).