CVE-2024-46626

OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload...

CVE-2023-38883

A reflected cross-site scripting XSS vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in 'ParentLookup.php'...

CVE-2024-51211

SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $usernamestnid parameter, which can be manipulated by an attacker to inject arbitrary SQL commands...

CVE-2024-51211

SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $usernamestnid parameter, which can be manipulated by an attacker to inject arbitrary SQL commands...

PT-2024-34564 · Os4Ed · Opensis Classic

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS-Classic version 9.1 Description: A SQL injection issue exists due to improper input validation of the username stn id parameter in the resetuserinfo.php file, allowing an attacker to inject arbitrary SQL commands. Recommendation...

CVE-2024-51211

OS4ED openSIS-Classic Version 9.1 (and potentially 9.0) is vulnerable to an unauthenticated SQL injection in the resetuserinfo.php file. The flaw stems from improper input validation of the $username_stn_id parameter, allowing remote attackers to inject arbitrary SQL commands and gain unauthorize...

CVE-2024-46626

OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload...

CVE-2024-46626

OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload...

CVE-2024-46626

The OS4ED openSIS-Classic v9.1 student information system contains a SQL injection vulnerability. An attacker can exploit this by sending a specially crafted payload via the X-Forwarded-For header parameter in a POST request to /Ajax.php . The vulnerability allows for boolean-based blind and erro...