SQL Injection Vulnerability in OS4ED openSIS Version 8.0
CVE-2021-40636

7.5HIGH

Key Information:

Vendor

Os4ed

Status
Opensis
Vendor
CVE Published:
3 March 2022

What is CVE-2021-40636?

The OS4ED openSIS 8.0 product suffers from a SQL Injection vulnerability in the CheckDuplicateName.php file. This weakness allows an attacker to manipulate SQL queries, potentially enabling them to extract sensitive information from the database, thereby jeopardizing the integrity and confidentiality of user data. It is essential for users of this version to implement appropriate security measures to mitigate possible exploitation.

References

https://github.com/OS4ED/openSIS-Classic/issues/198
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.