{"id":"CVE-2023-7096","aliases":["EUVD-2023-59280","GHSA-m54p-35qp-m26h"],"status":"published","title":"code-projects Faculty Management System crud.php sql injection","description":"A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00672,"percentile":0.52342,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74","CWE-89"],"published":"2023-12-25T01:00:06Z","modified":"2026-06-17T06:52:03Z","products":[{"vendor":"carmelogarcia","product":"faculty_management_system"},{"vendor":"code-projects","product":"faculty management system"}],"references":[{"url":"https://vuldb.com/?id.248948","tags":["vdb-entry","technical-description","x_transferred","Third Party Advisory"]},{"url":"https://vuldb.com/?ctiid.248948","tags":["signature","permissions-required","x_transferred","Permissions Required","Third Party Advisory"]},{"url":"https://vuldb.com/?submit.256818","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.703136","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.703137","tags":["third-party-advisory"]},{"url":"https://github.com/Glunko/vulnerability/blob/main/Faculty-Management-System_sql.md","tags":["exploit","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://code-projects.org/","tags":["product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7096"},{"url":"https://code-projects.org"},{"url":"https://github.com/advisories/GHSA-m54p-35qp-m26h"}],"sources":{"cve":[{"id":"CVE-2023-7096","title":"code-projects Faculty Management System crud.php sql injection","description":"A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.","status":"published","published":"2023-12-25T01:00:06.137Z","modified":"2025-12-11T08:35:37.713Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-89","CWE-74"],"updated_at":"2026-11-02T14:35:33.794347Z"}],"euvd":[{"id":"EUVD-2023-59280","description":"A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.","status":"published","published":"2023-12-25T01:00:06Z","modified":"2025-12-11T08:35:37Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:49:06.661228Z"}],"ghsa":[{"id":"GHSA-m54p-35qp-m26h","title":"A vulnerability was found in code-projects Faculty Management System 1.0. It has been rated as...","description":"A vulnerability was found in code-projects Faculty Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/php/crud.php. The manipulation of the argument fieldname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248948.","status":"published","published":"2023-12-25T03:30:27Z","modified":"2025-12-11T09:31:26Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-74","CWE-89"],"updated_at":"2026-11-02T15:05:09.214908Z"}],"nvd":[{"id":"CVE-2023-7096","description":"A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.","status":"published","published":"2023-12-25T01:15:08.457Z","modified":"2026-06-17T06:52:03.343Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:L/Au:M/C:P/I:P/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-74","CWE-89"],"updated_at":"2026-11-02T14:08:57.117371Z"}]}}