CVE-2022-3671

Deeper analysis

A critical SQL injection vulnerability, tracked as CVE-2022-3671 and assigned CWE-89, was discovered in SourceCodester eLearning System version 1.0. The flaw resides in the /admin/students/manage.php file, where unsanitized input to the id parameter allows an attacker to alter SQL queries. The issue received a CVSS 3.1 score of 6.3 and was publicly disclosed on 26 October 2022, with proof-of-concept code made available shortly afterward.

An authenticated attacker with low privileges can exploit the vulnerability remotely by supplying a crafted id value to the affected endpoint. Successful exploitation grants the ability to read, modify, or delete limited database contents, potentially exposing student records or administrative data within the eLearning application.

The EPSS score for this CVE remained low immediately after disclosure but rose materially to a peak of 0.0786 on 22 January 2025 before receding to its current value of 0.0007, indicating a later surge in observed exploitation interest that warrants renewed monitoring by defenders.