CVE-2024-1923: medium-severity vulnerability in SourceCodester Simple Student Attendance System
SourceCodester Simple Student Attendance System List of Classes Page ajax-api.php delete_student sql injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.8%
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as critical. Affected by this issue is the function delete_class/delete_student of the file /ajax-api.php of the component List of Classes Page. The manipulation of the argument id with the input 1337'+or+1=1;--+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254858 is the identifier assigned to this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
SourceCodester · Simple Student Attendance SystemRelated CVEs — SourceCodester Simple Student Attendance System
In the same product, most dangerous first.
CVE-2023-6657MEDIUMSourceCodester Simple Student Attendance System student_form.php sql injectionEPSS 0.9%CVE-2023-6618MEDIUMSourceCodester Simple Student Attendance System index.php file inclusionEPSS 0.9%CVE-2023-6658MEDIUMSourceCodester Simple Student Attendance System sql injectionEPSS 0.8%CVE-2023-6619MEDIUMSourceCodester Simple Student Attendance System class_form.php sql injectionEPSS 0.8%CVE-2023-6617MEDIUMSourceCodester Simple Student Attendance System attendance.php sql injectionEPSS 0.8%CVE-2023-7058MEDIUMSourceCodester Simple Student Attendance System path traversalEPSS 0.7%