SQL Injection Vulnerability in OS4ED openSIS Versions 7.0 to 9.1
CVE-2025-22925

7.5HIGH

Key Information:

Vendor

OS4ED

Status
openSIS
Vendor
CVE Published:
2 April 2025

What is CVE-2025-22925?

A SQL injection vulnerability exists in OS4ED openSIS within versions 7.0 to 9.1, allowing a remote authenticated attacker with admin privileges to exploit the system by manipulating the 'table' parameter in the /attendance/AttendanceCodes.php endpoint. This issue may lead to unauthorized data access or manipulation, emphasizing the importance of security best practices in web applications.

References

https://github.com/OS4ED/openSIS-Classic
https://github.com/esusalla/vulnerability-research/tree/m...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.