OpenSIS 7.3 - SQL Injection

OpenSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php. id: CVE-2020-6637 info: name: OpenSIS 7.3 - SQL Injection author: pikpikcu severity: critical description: OpenSIS Community Edition version 7.3 is vulnerable to SQL injection via the...

openSIS Classic v9.1 - SQL Injection

SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $usernamestnid parameter, which can be manipulated by an attacker to inject arbitrary SQL commands. id: CVE-2024-51211...

Opensis-Classic 8.0 - Cross-Site Scripting

Opensis-Classic Version 8.0 is affected by cross-site scripting. An unauthenticated user can inject and execute JavaScript code through the linkurl parameter in Ajaxurlencode.php. id: CVE-2021-40542 info: name: Opensis-Classic 8.0 - Cross-Site Scripting author: alph4byt3 severity: medium...

openSIS Student Information System 8.0 SQL Injection

openSIS Student Information System version 8.0 is susceptible to SQL injection via the studentid and TRANSFERSCHOOL parameters in POST request sent to /TransferredOutModal.php. id: CVE-2021-41691 info: name: openSIS Student Information System 8.0 SQL Injection author: Bartu Utku SARP severity: hi...

OS4Ed OpenSIS Community 8.0 - Local File Inclusion

OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php modname parameter, which can disclose arbitrary file from the server's filesystem as long as the application has access to the file. id: CVE-2021-40651 info: name: OS4Ed OpenSIS Community 8.0 - Local...

openSIS v9.0 - Path Traversal

A path traversal vulnerability exists in openSIS Classic Community Edition v9.0 via the 'filename' parameter in DownloadWindow.php. An unauthenticated remote attacker can exploit this to read arbitrary files on the server by manipulating file paths. id: CVE-2023-38879 info: name: openSIS v9.0 -...

openSIS < 9.1 - SQL Injection

SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1, 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application...

CVE-2024-35584

CVE-2024-35584 OpenSIS 认证 SQL 注入 描述 Ajax.php、ForWindow.php、ForExport.php、Modules.php、functions/HackingLogFnc.php 中存在 SQL 注入漏洞。该漏洞影响 OpenSis Community Edition 9.1 至 8.0，以及可能更低的版本。 概念验证 以 Ajax.php 为例，可以看到当检测到恶意活动时，IP 可以被记录并插入数据库。需要注意的一点是，如果发送了“X-Forwarded-For”头，应用程序将使用该值而不是 $SERVER'REMOTEADDR' 的值。由...

CVE-2021-39379

OPENSIS 8.0 SQL注入漏洞 CVE-2021-39379 在 openSIS 8.0 版本中存在一个 SQL 注入漏洞，当使用 MySQL MariaDB 作为应用数据库时。恶意攻击者可以通过存在漏洞的 passwordstnid 参数向 MySQL MariaDB 数据库发送 SQL 命令。 存在漏洞的 PHP 页面： ResetUserInfo.php 存在漏洞的 Payload sqlmap -u "http://localhost:8081/ResetUserInfo.php"...

CVE-2021-39378

VULNERABILIDAD DE INYECCIÓN SQL EN OPENSIS 8.0 CVE-2021-39378 Existe una vulnerabilidad de inyección SQL en la versión 8.0 de openSIS cuando se utiliza MySQL MariaDB como base de datos de la aplicación. Un atacante malicioso puede ejecutar comandos SQL en la base de datos MySQL MariaDB a través d...

CVE-2021-39377

OPENSIS 8.0 SQL 注入漏洞 CVE-2021-39377 当使用 MySQL（MariaDB）作为应用程序数据库时，openSIS 8.0 版本存在 SQL 注入漏洞。恶意攻击者可以通过易受攻击的 username= 参数向 MySQL（MariaDB）数据库发出 SQL 命令。 易受攻击的 PHP 页面： index.php - username 参数 易受攻击的 Payload sqlmap "http://localhost:8081/index.php" --users...

CVE-2026-103117

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103116

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LOsort causes sql injection. The attack can be initiated remotely. The...

CVE-2026-103115

A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The...

EUVD-2026-89949

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103117

A security vulnerability exists in OS4ED openSIS-Classic up to version 9.3. The flaw is located in the db_properties function within the functions/DatabaseInc.php file of the Save Data Handler component. Improper handling of argument values allows for a remote SQL injection attack. While the expl...

CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103116

A SQL injection vulnerability exists in OS4ED openSIS-Classic versions up to 9.3 . The flaw is located within the DBQuery function of the functions/GetStuListFnc.php file in the Student List Search Endpoint component. The vulnerability is triggered by the manipulation of the LO_sort argument, all...