CVE-2023-3007
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A critical vulnerability was found in ningzichun Student Management System version 1.0. The issue affects some unknown functionality of the file resetPassword.php in the Password Reset Handler component, where manipulation of the argument sid leads to weak password recovery.
Risk Assessment
An attacker may remotely exploit this vulnerability, posing a serious threat to user account security. The public disclosure of the exploit increases the risk of attacks.
Recommendation
It is recommended to immediately update the system to the latest version to eliminate this vulnerability. Additionally, consider implementing further security measures such as log monitoring and strengthening password recovery procedures.
Original NVD description (English source)
A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230354 is the identifier assigned to this vulnerability.