CVE-2022-3436: sourcecodester web-based student clearance system Incorrect Privilege Assignment
Vulnerability summary
CVE-2022-3436 is a high (CVSS 7.5) Incorrect Privilege Assignment vulnerability in sourcecodester web-based student clearance system. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.8% of scored vulnerabilities.
Timeline
- 09-10-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-210367.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.09 pp
From 0.54% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Sourcecodester1 product
Web-based_student_clearance_system_project1 product
2 vendors · 2 products