CVE-2020-6139

2020-09-0121:15:12

Google

osv.dev

8.2 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.5%

JSON

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

CPENameOperatorVersion
opensis-classiceq7.1
opensis-classiceqVer7.0Prod
opensis-classiceqVer7.0Prod_update
opensis-classiceqVer7.0beta1
opensis-classiceq7.3
opensis-classiceqer7.1
opensis-classiceq7.2

Name	Operator	Version
opensis-classic	eq	7.1
opensis-classic	eq	Ver7.0Prod
opensis-classic	eq	Ver7.0Prod_update
opensis-classic	eq	Ver7.0beta1
opensis-classic	eq	7.3
opensis-classic	eq	er7.1
opensis-classic	eq	7.2