CVE-2023-5011

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Kashipara Group	Student Information System	1.0

References

https://fluidattacks.com/advisories/kissin/Exploit, Third Party Advisory
https://www.kashipara.com/Not Applicable
https://fluidattacks.com/advisories/kissin/Exploit, Third Party Advisory
https://www.kashipara.com/Not Applicable

Timeline

Published: Dec 20, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-501107.5TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used.CVE-2023-50127.8A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program CVE-2023-501205.5MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_p CVE-2023-501215.7Autel EVO NANO drone flight control firmware version 1.6.5 is vulnerable to denial of service (DoS).CVE-2023-501238.1The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attacke CVE-2023-501246.8Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination wit CVE-2023-501255.9A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed st CVE-2023-501266.5Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical CVE-2023-501275.9Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from CVE-2023-501285.3The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which CVE-2023-501296.5Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity t CVE-2023-50135.4A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file instal