CVE-2023-6616

SourceCodester Simple Student Attendance System index.php cross site scripting

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.13.5Low EPSS percentile48th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2023-12-08Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

SourceCodester Simple Student Attendance SystemAffected: 1.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Simple Student Attendance System version 1.0 and whether staff access its index.php page.
Ask the software provider for a supported update; no fixed version or vendor patch is currently documented.
Until an update is available, restrict access to the attendance system to trusted staff and limit the page parameter to approved page names.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247253 was assigned to this vulnerability.

In plain language

Written by AI from the record

Simple Student Attendance System 1.0 has a low-severity web-page flaw; most small businesses should schedule remediation, especially if staff use it online.

Authenticated reflected cross-site scripting in Simple Student Attendance System 1.0 via manipulation of the `page` argument in `index.php`, requiring user interaction and permitting limited integrity impact.

If you're affected

Altered attendance records
Actions taken as staff
School administration disruption

What is it

A person with access to the system can prepare a misleading link that makes a staff member’s browser carry out unwanted actions when they open it. It is like placing a forged instruction inside a familiar-looking office form: the form appears normal, but it can cause the recipient to act on the attacker’s behalf.

Who is affected

This matters to you if you run Simple Student Attendance System version 1.0 to record or manage student attendance. An attacker needs a login and must get another user to open a crafted link or page.

How urgent is it

A public exploit is available, meaning attackers have a known method for attempting this attack. Treat this as an amber-priority issue: reduce access now and obtain vendor guidance, but it is not listed by CISA as a vulnerability known to be actively exploited.

What to do — in detail

Confirm the deployed product and version, then review whether index.php accepts a user-controlled page value. No fixed version, supported branch target, or vendor patch is documented, so do not assume an upgrade resolves CVE-2023-6616 until the provider confirms it.

If patching is delayed, enforce an allowlist of valid page values, restrict the application to trusted users or private network access, and prevent untrusted links from being sent to staff. Review web-server logs for unusual index.php?page= requests and investigate unexpected attendance changes or staff-account activity. CISA has not assigned a KEV remediation due date because this CVE is not in its catalog.

Technical context

CVE-2023-6616 is CWE-79 cross-site scripting affecting unknown processing in index.php when the page argument is manipulated. CVSS v3.1 is 3.5 (Low): AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. One public exploit is known, but CISA KEV does not list the CVE and the findings do not confirm active exploitation. EPSS is 0.6% (48th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS48th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 48th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 819 days, from the signal feeds we watch.

2026-03-06Public exploit / PoCsource: other
2024-11-21Record updated
2023-12-08Publishedweakness classified, att&ck mapped

Affected products

oretnom23commercial
- simple student attendance systemWeb AppOn-premEnterprise Software / itsm-monitoring
SourceCodestercommercial · PH
- Simple Student Attendance SystemWeb AppOn-premWeb & CMS Plugins

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Scored 3.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action