PT-2023-30926 · Unknown · Student Result Management System

Published 2023-12-28 · Updated 2024-01-02 · CVE-2023-48723

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Student Result Management System version 1.0

Description The issue concerns unauthenticated SQL Injection vulnerabilities. Specifically, the rno parameter of the "add results.php" resource does not validate the characters received, and they are sent unfiltered to the database.

Recommendations For Student Result Management System version 1.0, consider validating and filtering the rno parameter in the "add results.php" resource to prevent SQL Injection attacks. As a temporary workaround, restrict access to the "add results.php" resource until a proper fix is implemented.

Exploit

Related Identifiers

CVE-2023-48723

Affected Products

Student Result Management System

References · 3

• 🔥 https://fluidattacks.com/advisories/gilels · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48723 · Security Note
• https://t.me/cvenotify/65436 · Telegram Post