CVE-2024-58276CWE-89sql-injection

CVE-2024-58276

published December 5, 2025

CVSS
8.7
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames and passwords.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-05T02:16Z
References (3)
https://github.com/Obi08/Enrollment_System · [email protected]https://www.exploit-db.com/exploits/51845 · [email protected]https://www.vulncheck.com/advisories/obi08-enrollment-system-10-loginphp-sql-injection · [email protected]
EPSS history
Timeline
  • 04 DEC 20:41Z
    Obi08-Enrollment System 1.0 login.php SQL Injection
    cvelistv5