PT-2020-18958

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.4 Description A remote code execution issue exists in the install functionality. The username variable, set at line 121 in install/Step5.php, allows for injection of PHP code into the Data.php file. An attacker can send...

PT-2020-18957

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.4 Description A remote code execution issue exists in the install functionality. The password variable, set at line 122 in install/Step5.php, allows for injection of PHP code into the Data.php file. An attacker can send...

CVE-2020-6144: Improper Neutralization of Directives in Statically Saved Code

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this...

CVE-2020-6143: Improper Neutralization of Directives in Statically Saved Code

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this...

OS4Ed openSIS install remote code execution vulnerability

Summary A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. A specially crafted HTTP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions OS4Ed openSIS 7.4 Product URLs...