{"schemaVersion":3,"id":"CVE-2023-6618","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247255.","dates":{"published":"2023-12-08T17:00:09.032Z","modified":"2025-05-27T17:13:40.622Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":5.5,"severity":"medium","vector":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"CVE.org","score":5.2,"severity":"medium","vector":"AV:A/AC:L/Au:S/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5.2,"severity":"medium","vector":"AV:A/AC:L/Au:S/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00862,"percentile":0.57908,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00862},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00862,"percentile":0.57908}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00862,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00862,"percentile":0.57908}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_E016B204367E6E7C","name":"Exploit Reference (yuque.com)","source":"reference","url":"https://www.yuque.com/u39339523/el4dxs/krpez3nzv1144cuc","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-73","name":"External Control of File Name or Path","description":"The product allows user input to control or influence paths or file names that are used in filesystem operations.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/73.html"},{"id":"CWE-610","name":"Externally Controlled Reference to a Resource in Another Sphere","description":"The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/610.html"}],"affected":[{"vendor":"oretnom23","product":"simple_student_attendance_system","name":"simple student attendance system","label":"simple_student_attendance_system","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.0","eol":null,"hubHref":"/vendor/oretnom23/simple_student_attendance_system"},{"vendor":"sourcecodester","product":"simple student attendance system","name":"Simple Student Attendance System","label":"simple student attendance system","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.0","eol":null,"hubHref":"/vendor/sourcecodester/simple_student_attendance_system"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://vuldb.com/?id.247255","label":"vuldb.com?id.247255","hostname":"vuldb.com","tags":["VDB Entry","Technical Description","Third Party Advisory"]},{"url":"https://vuldb.com/?ctiid.247255","label":"vuldb.com?ctiid.247255","hostname":"vuldb.com","tags":["Signature","Permissions Required","Third Party Advisory"]},{"url":"https://www.yuque.com/u39339523/el4dxs/krpez3nzv1144cuc","label":"www.yuque.com/u39339523/el4dxs/krpez3nzv1144cuc","hostname":"www.yuque.com","tags":["Exploit","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-12-08T17:00:09.032Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-05-27T17:13:40.622Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":45,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:11:02.639Z","stale":false,"partial":false}}