CVE-2023-6648

A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file password-recovery.php. The manipulation of the argument username/contactno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

• CWE-74
• CWE-89

• https://github.com/dhabaleshwar/niv_testing_sqliforgotpassword/blob/main/exploit.mdExploit, Mitigation, Third Party Advisory
• https://phpgurukul.com/Product
• https://vuldb.com/?ctiid.247341Permissions Required, Third Party Advisory
• https://vuldb.com/?id.247341Permissions Required, Third Party Advisory
• https://vuldb.com/?submit.246745Third Party Advisory, VDB Entry
• https://github.com/dhabaleshwar/niv_testing_sqliforgotpassword/blob/main/exploit.mdExploit, Mitigation, Third Party Advisory
• https://vuldb.com/?ctiid.247341Permissions Required, Third Party Advisory
• https://vuldb.com/?id.247341Permissions Required, Third Party Advisory

Published

Dec 10, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6637The CAOS | Host Google Analytics Locally plugin for WordPres…5.3
• CVE-2023-6638The GTG Product Feed for Shopping plugin for WordPress is vu…5.3
• CVE-2023-6640Malformed S2 Nonce Get Command Class packets can be sent to …6.5
• CVE-2023-6645The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPr…5.4
• CVE-2023-6646A vulnerability classified as problematic has been found in …5.4
• CVE-2023-6647A vulnerability, which was classified as critical, has been …9.8
• CVE-2023-6649A vulnerability has been found in PHPGurukul Teacher Subject…6.1
• CVE-2023-6650A vulnerability was found in SourceCodester Simple Invoice G…6.1
• CVE-2023-6651A vulnerability was found in code-projects Matrimonial Site …9.8
• CVE-2023-6652A vulnerability was found in code-projects Matrimonial Site …9.8
• CVE-2023-6653A vulnerability was found in PHPGurukul Teacher Subject Allo…4.3
• CVE-2023-6654A vulnerability classified as critical was found in PHPEMS 6…8.8