CVE-2023-33584

Deeper analysis

Sourcecodester Enrollment System Project V1.0 contains a SQL injection vulnerability tracked as CVE-2023-33584. The flaw stems from insufficient validation of user input in the username and password fields of the login process, allowing crafted SQL statements to be executed against the backend database. The issue is classified under CWE-89 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.

An unauthenticated attacker can supply malicious input during login to bypass authentication, extract or modify database contents, and potentially obtain administrative control of the enrollment system. Public exploit code demonstrating authentication bypass via SQL injection has been published on multiple platforms shortly after disclosure.

The EPSS score rose from a low baseline to a peak of 0.3456 before settling at the current value of 0.3065, indicating a clear increase in observed exploitation interest following public release of the vulnerability details. No official vendor patches or mitigation guidance appear among the available references, which consist primarily of proof-of-concept exploits.