SQL Injection Vulnerability in OpenSIS by OS4Ed
CVE-2021-40309
8.8HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2021-40309?
A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. This issue arises from the cp_id_miss_attn parameter in TakeAttendance.php, which allows an attacker to inject arbitrary SQL queries. Exploitation requires an attacker to authenticate as a user with access to the 'Take Attendance' feature, potentially leading to unauthorized data manipulation and exposure. It’s vital for organizations using OpenSIS to review user access permissions and apply necessary patches to mitigate this risk.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.