Search criteria

9 vulnerabilities found for student_information_system by kashipara

FKIE_CVE-2023-5010

Vulnerability from fkie_nvd - Published: 2023-12-20 16:15 - Updated: 2025-12-05 16:08
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
References
help@fluidattacks.comhttps://fluidattacks.com/advisories/kissin/Exploit, Third Party Advisory
help@fluidattacks.comhttps://www.kashipara.com/Not Applicable
af854a3a-2127-422b-91ae-364da2661108https://fluidattacks.com/advisories/kissin/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.kashipara.com/Not Applicable
Impacted products
Vendor Product Version
kashipara student_information_system 1.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kashipara:student_information_system:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FFC17D8-97FB-4250-9882-1A0A16F9F122",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursecode\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database."
    },
    {
      "lang": "es",
      "value": "Student Information System v1.0 es afectado por m\u00faltiples vulnerabilidades de inyecci\u00f3n SQL autenticada. El par\u00e1metro \u0027coursecode\u0027 del recurso marks.php no valida los caracteres recibidos y se env\u00edan sin filtrar a la base de datos."
    }
  ],
  "id": "CVE-2023-5010",
  "lastModified": "2025-12-05T16:08:36.447",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "help@fluidattacks.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2023-12-20T16:15:10.197",
  "references": [
    {
      "source": "help@fluidattacks.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://fluidattacks.com/advisories/kissin/"
    },
    {
      "source": "help@fluidattacks.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.kashipara.com/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://fluidattacks.com/advisories/kissin/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.kashipara.com/"
    }
  ],
  "sourceIdentifier": "help@fluidattacks.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "help@fluidattacks.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-5011

Vulnerability from fkie_nvd - Published: 2023-12-20 16:15 - Updated: 2025-12-05 16:15
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
References
help@fluidattacks.comhttps://fluidattacks.com/advisories/kissin/Exploit, Third Party Advisory
help@fluidattacks.comhttps://www.kashipara.com/Not Applicable
af854a3a-2127-422b-91ae-364da2661108https://fluidattacks.com/advisories/kissin/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.kashipara.com/Not Applicable
Impacted products
Vendor Product Version
kashipara student_information_system 1.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kashipara:student_information_system:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FFC17D8-97FB-4250-9882-1A0A16F9F122",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursename\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database."
    },
    {
      "lang": "es",
      "value": "Student Information System v1.0 es afectado por m\u00faltiples vulnerabilidades de inyecci\u00f3n SQL autenticada. El par\u00e1metro \u0027coursename\u0027 del recurso marks.php no valida los caracteres recibidos y se env\u00edan sin filtrar a la base de datos."
    }
  ],
  "id": "CVE-2023-5011",
  "lastModified": "2025-12-05T16:15:09.327",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "help@fluidattacks.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-12-20T16:15:10.400",
  "references": [
    {
      "source": "help@fluidattacks.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://fluidattacks.com/advisories/kissin/"
    },
    {
      "source": "help@fluidattacks.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.kashipara.com/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://fluidattacks.com/advisories/kissin/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.kashipara.com/"
    }
  ],
  "sourceIdentifier": "help@fluidattacks.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "help@fluidattacks.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-5007

Vulnerability from fkie_nvd - Published: 2023-12-20 16:15 - Updated: 2025-12-05 16:07
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
References
help@fluidattacks.comhttps://fluidattacks.com/advisories/kissin/Exploit, Third Party Advisory
help@fluidattacks.comhttps://www.kashipara.com/Not Applicable
af854a3a-2127-422b-91ae-364da2661108https://fluidattacks.com/advisories/kissin/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.kashipara.com/Not Applicable
Impacted products
Vendor Product Version
kashipara student_information_system 1.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kashipara:student_information_system:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FFC17D8-97FB-4250-9882-1A0A16F9F122",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027id\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database."
    },
    {
      "lang": "es",
      "value": "Student Information System v1.0 es afectado por m\u00faltiples vulnerabilidades de inyecci\u00f3n SQL autenticada. El par\u00e1metro \u0027id\u0027 del recurso marks.php no valida los caracteres recibidos y se env\u00edan sin filtrar a la base de datos."
    }
  ],
  "id": "CVE-2023-5007",
  "lastModified": "2025-12-05T16:07:57.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "help@fluidattacks.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2023-12-20T16:15:09.987",
  "references": [
    {
      "source": "help@fluidattacks.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://fluidattacks.com/advisories/kissin/"
    },
    {
      "source": "help@fluidattacks.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.kashipara.com/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://fluidattacks.com/advisories/kissin/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.kashipara.com/"
    }
  ],
  "sourceIdentifier": "help@fluidattacks.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "help@fluidattacks.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-5007 (GCVE-0-2023-5007)

Vulnerability from cvelistv5 – Published: 2023-12-20 15:58 – Updated: 2025-05-19 18:36
VLAI?
Title
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
Summary
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
Vendor Product Version
Kashipara Group Student Information System Affected: 1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:44:53.279Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://fluidattacks.com/advisories/kissin/"
          },
          {
            "tags": [
              "product",
              "x_transferred"
            ],
            "url": "https://www.kashipara.com/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5007",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T20:17:07.891822Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-16T18:24:47.219Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Student Information System",
          "vendor": "Kashipara Group",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "datePublic": "2023-12-06T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStudent Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027id\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.\u003c/p\u003e"
            }
          ],
          "value": "Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027id\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T18:36:26.364Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://fluidattacks.com/advisories/kissin/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.kashipara.com/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2023-5007",
    "datePublished": "2023-12-20T15:58:34.088Z",
    "dateReserved": "2023-09-15T21:43:30.060Z",
    "dateUpdated": "2025-05-19T18:36:26.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5011 (GCVE-0-2023-5011)

Vulnerability from cvelistv5 – Published: 2023-12-20 15:57 – Updated: 2025-05-19 18:35
VLAI?
Title
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
Summary
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
Vendor Product Version
Kashipara Group Student Information System Affected: 1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:44:53.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://fluidattacks.com/advisories/kissin/"
          },
          {
            "tags": [
              "product",
              "x_transferred"
            ],
            "url": "https://www.kashipara.com/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Student Information System",
          "vendor": "Kashipara Group",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "datePublic": "2023-12-06T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStudent Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursename\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.\u003c/p\u003e"
            }
          ],
          "value": "Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursename\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T18:35:54.793Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://fluidattacks.com/advisories/kissin/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.kashipara.com/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2023-5011",
    "datePublished": "2023-12-20T15:57:19.012Z",
    "dateReserved": "2023-09-15T22:56:03.585Z",
    "dateUpdated": "2025-05-19T18:35:54.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5010 (GCVE-0-2023-5010)

Vulnerability from cvelistv5 – Published: 2023-12-20 15:55 – Updated: 2025-05-19 18:34
VLAI?
Title
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
Summary
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
Vendor Product Version
Kashipara Group Student Information System Affected: 1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:44:53.671Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://fluidattacks.com/advisories/kissin/"
          },
          {
            "tags": [
              "product",
              "x_transferred"
            ],
            "url": "https://www.kashipara.com/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5010",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-27T19:56:37.938230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-27T19:57:40.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Student Information System",
          "vendor": "Kashipara Group",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "datePublic": "2023-12-06T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStudent Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursecode\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.\u003c/p\u003e"
            }
          ],
          "value": "Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursecode\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T18:34:51.808Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://fluidattacks.com/advisories/kissin/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.kashipara.com/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2023-5010",
    "datePublished": "2023-12-20T15:55:07.052Z",
    "dateReserved": "2023-09-15T22:52:20.378Z",
    "dateUpdated": "2025-05-19T18:34:51.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5007 (GCVE-0-2023-5007)

Vulnerability from nvd – Published: 2023-12-20 15:58 – Updated: 2025-05-19 18:36
VLAI?
Title
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
Summary
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
Vendor Product Version
Kashipara Group Student Information System Affected: 1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:44:53.279Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://fluidattacks.com/advisories/kissin/"
          },
          {
            "tags": [
              "product",
              "x_transferred"
            ],
            "url": "https://www.kashipara.com/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5007",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T20:17:07.891822Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-16T18:24:47.219Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Student Information System",
          "vendor": "Kashipara Group",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "datePublic": "2023-12-06T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStudent Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027id\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.\u003c/p\u003e"
            }
          ],
          "value": "Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027id\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T18:36:26.364Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://fluidattacks.com/advisories/kissin/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.kashipara.com/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2023-5007",
    "datePublished": "2023-12-20T15:58:34.088Z",
    "dateReserved": "2023-09-15T21:43:30.060Z",
    "dateUpdated": "2025-05-19T18:36:26.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5011 (GCVE-0-2023-5011)

Vulnerability from nvd – Published: 2023-12-20 15:57 – Updated: 2025-05-19 18:35
VLAI?
Title
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
Summary
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
Vendor Product Version
Kashipara Group Student Information System Affected: 1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:44:53.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://fluidattacks.com/advisories/kissin/"
          },
          {
            "tags": [
              "product",
              "x_transferred"
            ],
            "url": "https://www.kashipara.com/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Student Information System",
          "vendor": "Kashipara Group",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "datePublic": "2023-12-06T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStudent Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursename\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.\u003c/p\u003e"
            }
          ],
          "value": "Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursename\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T18:35:54.793Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://fluidattacks.com/advisories/kissin/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.kashipara.com/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2023-5011",
    "datePublished": "2023-12-20T15:57:19.012Z",
    "dateReserved": "2023-09-15T22:56:03.585Z",
    "dateUpdated": "2025-05-19T18:35:54.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5010 (GCVE-0-2023-5010)

Vulnerability from nvd – Published: 2023-12-20 15:55 – Updated: 2025-05-19 18:34
VLAI?
Title
Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)
Summary
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
Vendor Product Version
Kashipara Group Student Information System Affected: 1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:44:53.671Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://fluidattacks.com/advisories/kissin/"
          },
          {
            "tags": [
              "product",
              "x_transferred"
            ],
            "url": "https://www.kashipara.com/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5010",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-27T19:56:37.938230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-27T19:57:40.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Student Information System",
          "vendor": "Kashipara Group",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "datePublic": "2023-12-06T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStudent Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursecode\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.\u003c/p\u003e"
            }
          ],
          "value": "Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The \u0027coursecode\u0027 parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T18:34:51.808Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://fluidattacks.com/advisories/kissin/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.kashipara.com/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2023-5010",
    "datePublished": "2023-12-20T15:55:07.052Z",
    "dateReserved": "2023-09-15T22:52:20.378Z",
    "dateUpdated": "2025-05-19T18:34:51.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}