Broken Access Control in OS4ED's openSIS Classic Database Backup Functionality
CVE-2023-38880

9.8CRITICAL

Key Information:

Vendor

Os4ed

Status
Opensis
Vendor
CVE Published:
20 November 2023

What is CVE-2023-38880?

The openSIS Classic Community Edition version 9.0 features a broken access control vulnerability in its database backup functionality. When an administrator creates a database backup, the backup file is stored in the web root directory and follows a predictable naming convention, such as 'opensisBackup.sql'. This design flaw allows any unauthenticated user to access the backup file, which contains a complete dump of the database, including sensitive data like password hashes. As a result, this vulnerability poses a significant risk to user data integrity and confidentiality.

References

https://github.com/OS4ED/openSIS-Classic
https://www.os4ed.com/
https://github.com/dub-flow/vulnerability-research/tree/m...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.