{"id":"CVE-2023-5010","aliases":["EUVD-2023-57356","GHSA-xf73-8777-6w59"],"status":"published","title":"Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)","description":"Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00673,"percentile":0.52405,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2023-12-20T15:55:07Z","modified":"2026-06-17T06:47:20Z","products":[{"vendor":"code-projects","product":"student information system"},{"vendor":"kashipara","product":"student_information_system"},{"vendor":"kashipara group","product":"student information system"}],"references":[{"url":"https://fluidattacks.com/advisories/kissin/","tags":["third-party-advisory","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.kashipara.com/","tags":["product","x_transferred","Not Applicable"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5010"},{"url":"https://fluidattacks.com/advisories/kissin"},{"url":"https://www.kashipara.com"},{"url":"https://github.com/advisories/GHSA-xf73-8777-6w59"}],"sources":{"cve":[{"id":"CVE-2023-5010","title":"Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)","description":"Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.","status":"published","published":"2023-12-20T15:55:07.052Z","modified":"2025-05-19T18:34:51.808Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:35:16.771348Z"}],"euvd":[{"id":"EUVD-2023-57356","description":"Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.","status":"published","published":"2023-12-20T15:55:07Z","modified":"2025-05-19T18:34:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:43.763029Z"}],"ghsa":[{"id":"GHSA-xf73-8777-6w59","title":"Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection...","description":"Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.","status":"published","published":"2023-12-20T18:30:32Z","modified":"2025-05-19T21:31:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:02:21.932853Z"}],"nvd":[{"id":"CVE-2023-5010","description":"Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.","status":"published","published":"2023-12-20T16:15:10.197Z","modified":"2026-06-17T06:47:20.213Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:08:56.329586Z"}]}}