PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-5634 Arslansoft Education Portal Project CVE debrief

CVE-2023-5634 is a critical SQL injection vulnerability in Arslansoft Education Portal affecting versions before 1.1. The NVD record classifies the issue as CWE-89 and rates it 9.8/CRITICAL, with a network-reachable attack path that does not require authentication. The practical takeaway is straightforward: if you run an affected deployment, treat this as a high-priority patching issue and move to a fixed release as soon as possible.

Vendor
Arslansoft Education Portal Project
Product
Arslansoft Education Portal
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-12-01
Original CVE updated
2026-05-21
Advisory published
2023-12-01
Advisory updated
2026-05-21

Who should care

Administrators, developers, and security teams responsible for Arslansoft Education Portal deployments before v1.1. Organizations exposing the portal to untrusted networks should prioritize this immediately.

Technical summary

The NVD entry maps CVE-2023-5634 to the Arslansoft Education Portal project and shows the vulnerable version range as anything before v1.1. The weakness is listed as CWE-89 (SQL Injection). The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable issue with no privileges or user interaction required and potential for full impact to confidentiality, integrity, and availability.

Defensive priority

Urgent. This is a critical, remotely exploitable SQL injection issue with no authentication requirement and high impact ratings. Patch or upgrade should be treated as immediate priority for any exposed or production deployment.

Recommended defensive actions

  • Upgrade Arslansoft Education Portal to version 1.1 or later.
  • Inventory all instances of the portal to confirm which deployments are affected.
  • If immediate upgrade is not possible, limit exposure to trusted networks and apply compensating controls until remediation is complete.
  • Review application and database logs for unusual query patterns or unexpected errors around the affected service.
  • Follow the referenced USOM advisory for any vendor or mitigation guidance associated with this CVE.

Evidence notes

The supplied NVD data identifies the vulnerable CPE as arslansoft_education_portal_project:arslansoft_education_portal with the vulnerable range ending before 1.1. The weakness is explicitly tagged CWE-89. The record also includes third-party advisory references from USOM (tr-23-0670). No KEV listing or ransomware linkage is present in the supplied corpus.

Official resources

Publicly disclosed in the CVE record on 2023-12-01 and last modified on 2026-05-21. The supplied corpus does not mark it as a CISA KEV entry or associate it with a known ransomware campaign.