Sql injection

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...

CVE-2021-40353

OpenSIS CVE-2021-40353 affects OpenSIS 8.0 when using MySQL/MariaDB. The vulnerability is an SQL injection exploitable via the USERNAME parameter on index.php, consistent with prior CVE-2020-6637 fixes. Connected sources (NVD entry and related CVE records) confirm the vulnerable entry points and ...

CVE-2021-40353

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...

Open Solutions For Education openSIS SQL注入漏洞

openSIS is a free and open source student information system/school management software. openSIS version 8.0 is vulnerable to SQL injection when using MySQL MariaDB as the application database. An attacker can use the index.php username parameter to issue SQL commands to the MySQL MariaDB databas...

Open Solutions For Education openSIS SQL注入漏洞

Open Solutions For Education openSIS is an open source student information management system from Open Solutions for Education Open Solutions For Education. A SQL injection vulnerability exists in openSIS because the product does not validate the USERNAME parameter on the index.php page. The...

Open Solutions For Education openSIS SQL注入漏洞

openSIS is a free and open source student information system/school management software. openSIS version 8.0 is vulnerable to SQL injection when using MySQL MariaDB as the application database. The vulnerability can be exploited to issue SQL commands to the MySQL MariaDB database via the...

Open Solutions For Education openSIS SQL注入漏洞

openSIS is a free and open source student information system/school management software. openSIS version 8.0 is vulnerable to SQL injection when using MySQL MariaDB as the application database. An attacker can exploit this vulnerability to issue SQL commands to the MySQL MariaDB database via the...

Exploit for SQL Injection in Os4Ed Opensis

CVE-2021-40353 CVE-2021-40353 openSIS 8.0 SQL Injection Vulner...

Path Traversal in os4ed/opensis-classic

✍️ Description The module.php modname parameter in OpenSIS 8.0 is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.; 🕵️‍♂️ Proof of Concept // Modules.php GET /Modules.php?modname=../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1 302...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

Cross site scripting

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

Design/Logic Flaw

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27408

OpenSIS Community Edition up to version 7.6 is affected by an access-control flaw in ResetUserInfo.php that lets an unauthenticated attacker change arbitrary user passwords. The root cause is improper access controls on the ResetUserInfo.php endpoint, enabling password modification without authen...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter. The issue is consistently described across connected sources as CVE-2020-27409. No explicit exploit details or patch version are provided in the connecte...

Open Solutions For Education openSIS Encryption Problem Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions for Education OSE. A vulnerability exists in OpenSIS Community Edition version 7.6 and prior versions due to an encryption issue that originates from incorrect access controls in the...