CVE-2020-6140

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6140

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6140

CVE-2020-6140 affects OS4Ed openSIS 7.3. Multiple SQL injection vulnerabilities exist in the password reset flow (ResetUserInfo.php) via parameters such as password_stf_email , uname , and username_stf_email . Root cause described as lack of input sanitization in the reset logic, enabling arbitra...