Reflected Cross-Site Scripting Vulnerability in OS4ED's openSIS Classic Community Edition
CVE-2023-38881

6.1MEDIUM

Key Information:

Vendor

Os4ed

Status
Opensis
Vendor
CVE Published:
20 November 2023

What is CVE-2023-38881?

A reflected cross-site scripting vulnerability exists in the Community Edition version 9.0 of OS4ED's openSIS Classic. This flaw enables remote attackers to execute arbitrary JavaScript in users' web browsers by injecting malicious payloads into parameters such as 'calendar_id', 'school_date', 'month', or 'year' within the CalendarModal.php script. If exploited, this vulnerability can lead to unauthorized actions, data theft, and session hijacking, posing significant security risks for users and institutions leveraging this software.

References

https://github.com/OS4ED/openSIS-Classic
https://www.os4ed.com/
https://github.com/dub-flow/vulnerability-research/tree/m...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.