CVE-2023-41503

The vulnerability results from a lack of proper validation and sanitization of input data passed to the login function (CWE-94 — code injection). An attacker can inject malicious SQL code directly into the login form fields, thereby modifying the query sent to the database. The attack does not require authentication, any user-side interaction, or special network conditions.

An attacker can gain unauthorized access to the application (including bypassing the authentication mechanism), read, modify or delete data from the database, and potentially take full control of the database system.

Patches available from the vendor should be applied according to the references. Additionally, it is recommended to implement parameterized SQL queries (prepared statements) and server-side input validation mechanisms. It is also recommended to restrict access to the application at the firewall level to trusted IP addresses.

Code-Projects Student Enrollment In PHP v1.0