CVE-2023-6618: oretnom23 simple_student_attendance_system External Control of File Name or Path
Vulnerability summary
CVE-2023-6618 is a high (CVSS 8.8) External Control of File Name or Path vulnerability in oretnom23 simple_student_attendance_system. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 08-12-2023PublishedVulnerability first disclosed.
- 27-05-2025Last modifiedVulnerability information updated.
Description
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247255.
CVSS metrics
5 scores · 2 sources · 3 versions- CVE.orgCNA5.5MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- NVDNIST5.2MediumAV:A/AC:L/Au:S/C:P/I:P/A:P
EPSS trend
Probability
0.86%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
0.00 pp
From 0.86% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (yuque.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Oretnom231 product
Sourcecodester1 product
2 vendors · 2 products