CVE-2023-2152: oretnom23 student_study_center_desk_management_system External Control of File Name or Path
Vulnerability summary
CVE-2023-2152 is a critical (CVSS 9.8) External Control of File Name or Path vulnerability in oretnom23 student_study_center_desk_management_system. EPSS estimates a 1.16% chance of exploitation in the next 30 days, higher than 66.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 18-04-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226273 was assigned to this vulnerability.
CVSS metrics
5 scores · 2 sources · 3 versions- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
- NVDNIST5.0MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS trend
Probability
1.16%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.16% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundVul
Maturity: poc
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Oretnom231 product
Sourcecodester1 product
2 vendors · 2 products