CVE-2023-5495

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in QDocs Smart School 6.4.1. It has been classified as critical. This affects an unknown part of the file /course/filterRecords/ of the component HTTP POST Request Handler. The manipulation of the argument searchdata[0][title]/searchdata[0][searchfield]/searchdata[0][searchvalue] leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-241647. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
QDocs	Smart School	6.4.1

References

http://packetstormsecurity.com/files/175071/Smart-School-6.4.1-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://vuldb.com/?ctiid.241647Permissions Required, Third Party Advisory
https://vuldb.com/?id.241647Third Party Advisory
http://packetstormsecurity.com/files/175071/Smart-School-6.4.1-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://vuldb.com/?ctiid.241647Permissions Required, Third Party Advisory
https://vuldb.com/?id.241647Third Party Advisory

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-54965.4A vulnerability was found in Translator PoqDev Add-On 1.0.11 on Firefox. It has been rated as problematic. This issue affects some unknown p CVE-2023-54978.8A vulnerability classified as critical has been found in Tongda OA 2017 11.10. Affected is an unknown function of the file general/hr/salary CVE-2023-54984.3Cross-Site Request Forgery (CSRF) in GitHub repository chiefonboarding/chiefonboarding prior to v2.0.47.CVE-2023-54997.5Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the wee CVE-2023-55008.8This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code ('Code Injection') to gain CVE-2023-55025.9On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access CVE-2023-55048.7The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This CVE-2023-55056.8The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup f CVE-2023-55064.3The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area CVE-2023-55075.4The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including,CVE-2023-55095.4The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the act CVE-2023-55118.8Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.