Student Information System
CVE-2023-4122
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.
AnalysisAI
Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application. Affected products include: Imsurajghosh Student Information System.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.
More in Student Information System
View allStudent Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter
Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Info
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high severi
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high severi
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high severi
An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remo
A vulnerability classified as critical was found in SourceCodester Student Information System. Rated critical severity (
A flaw has been found in code-projects Student Information System 1.0. This issue affects some unknown processing of the
A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS
Cross-site scripting (XSS) via unsanitized firstname and lastname parameters in /profile.php of code-projects Student In
A vulnerability, which was classified as problematic, was found in Student Information System 1.0. Rated medium severity
Share
External POC / Exploit Code
Leaving vuln.today