CVE-2025-51567
CriticalSummary
SQL Injection vulnerability in /exam/user/profile.php of kashipara Online Exam System V1.0. Remote attackers can execute arbitrary SQL commands to gain unauthorized database access via the rname, rcollage, rnumber, rgender, and rpassword parameters in a POST request.
Risk Assessment
An attacker can access sensitive data, modify the database, or bypass authentication, posing a serious security threat.
Recommendation
Apply patches or use parameterized SQL queries, and restrict access to the application.
Original NVD description (English source)
A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the rname, rcollage, rnumber, rgender and rpassword parameters in a POST HTTP request.