CVE-2023-51801 is a SQL injection flaw in Simple Student Attendance System 1.0 by oretnom23. The id parameter of student_form.php and class_form.php is not handled safely. The record rates it Critical at 9.8. No fixed version is named, so remove the app from public access or replace it.
What's affected
Simple Student Attendance System version 1.0. The record names the product under the oretnom23 vendor tag, a publisher of free sample PHP projects. It does not list a fixed version and we found no vendor advisory, so we cannot point to a patch.
The record's CWE is CWE-94, code injection, while the description says SQL injection. SQL injection is normally CWE-89. We follow the description, since it states the mechanism.
The record gives a CVSS score of 9.8 (Critical). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-94.
How to check if you're exposed
Check whether this application is running anywhere. Look on web servers for a directory named for the project, or for the files student_form.php and class_form.php. Your web server's access logs will show whether those pages receive traffic.
If you find it, note who deployed it and what database it connects to. Sample applications are often installed for a demo and left behind.
What to do now
- Find every copy of the application in your environment.
- Take it off the public internet, or remove it if it is not needed.
- If it must stay, put it behind authentication and a network restriction, and run its database account with the least rights possible.
- Review the database for unexpected data changes or new accounts, and check web logs for odd requests to the two affected pages.
- Plan a replacement with a maintained product, since no fix is published.
Why it matters
SQL injection happens when user input is placed into a database query as if it were part of the query itself. The record says the id parameter in two pages is affected. Anyone who can reach those pages can influence what the database runs.
The 9.8 score reflects that no login is needed and the impact on confidentiality, integrity and availability is high. A database behind a school attendance system may hold names and records of minors, which adds regulatory weight to a leak.
Free sample projects are a recurring source of CVEs. They are written to demonstrate, not to defend, and they rarely get patches. Treat any such app as a liability.
Quick check
Is there a fix?
No fixed version is named in the record or in the source we read. Remove or replace the application.
Does the attacker need an account?
Not according to the vector. It requires no privileges and no user interaction.
Sources
Last reviewed: 19 October 2026.
