PT-2020-18937

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A sql injection issue exists in the email parameter functionality. The email parameter in the page EmailCheck.php is vulnerable to sql injection, allowing an attacker to make an authenticated HTTP request ...

CVE-2020-6124: Improper Neutralization of Special Elements used in an SQL Command

An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. The email parameter in the page EmailCheckOthers.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-6132: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page ChooseCP.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-6137: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

PT-2020-18951

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the password reset functionality. The password stf email parameter in the "/opensis/ResetUserInfo.php" API endpoint is vulnerable to SQL injection, allowing an attacker to...

PT-2020-18934

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the CheckDuplicateStudent.php page. The fn parameter in this page is vulnerable to SQL injection. An attacker can trigger this issue by making an authenticated HTTP request ...

PT-2020-18958

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.4 Description A remote code execution issue exists in the install functionality. The username variable, set at line 121 in install/Step5.php, allows for injection of PHP code into the Data.php file. An attacker can send...

PT-2020-18945

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description SQL injection vulnerabilities exist in the course period id parameters used in OS4Ed openSIS pages. The course period id parameter in the page "MassScheduleSessionSet.php" is vulnerable to SQL injection. A...

PT-2020-18936

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the CheckDuplicateStudent.php page. The mn parameter in this page is vulnerable to SQL injection. An attacker can trigger this issue by making an authenticated HTTP request ...

PT-2020-18946

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the ID parameters of OS4Ed openSIS pages, specifically in the id parameter of the ChooseCP.php page. This allows an attacker to make an authenticated HTTP request to trigger...

PT-2020-18933

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page. The byear parameter in this page is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger thi...

PT-2020-18942

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the CoursePeriodModal.php page. This can be triggered by a specially crafted HTTP request, allowing an attacker to exploit the meet date parameter in the CoursePeriodModal.p...

CVE-2020-6139: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The usernamestfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

PT-2020-18932

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description The issue concerns SQL injection vulnerabilities in the CheckDuplicateStudent.php page. Specifically, the bmonth parameter in this page is vulnerable to SQL injection. An attacker can exploit this by makin...

CVE-2020-6143: Improper Neutralization of Directives in Statically Saved Code

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this...

PT-2020-18954

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the password reset functionality. The password stf email parameter in the "/opensis/ResetUserInfo.php" API endpoint is vulnerable to SQL injection, allowing an attacker to...

PT-2020-18955

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description An exploitable SQL injection issue exists in the login functionality. A specially crafted HTTP request can lead to SQL injection, allowing an attacker to send an HTTP request to trigger this issue...

PT-2020-18940

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the CoursePeriodModal.php page. The course period id parameter in this page is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger thi...

PT-2020-18939

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description An exploitable SQL injection issue exists in the GetSchool.php functionality. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this...

PT-2020-18953

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the password reset functionality. The username stf email parameter in the "/opensis/ResetUserInfo.php" API endpoint is vulnerable to SQL injection, allowing an attacker to...