CVE-2023-38879

openSIS Classic Community Edition v9.0 is affected by a path traversal in the filename parameter of DownloadWindow.php, enabling unauthenticated remote reading of arbitrary server files. The Nuclei template for CVE-2023-38879 corroborates the vulnerability, naming the endpoint and impact. Root ca...

CVE-2023-38884

An Insecure Direct Object Reference IDOR vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/-'...

CVE-2023-38881

A reflected cross-site scripting XSS vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendarid', 'schooldate', 'month' or 'year'...

CVE-2023-38885

OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery CSRF protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request...

CVE-2023-38884

CVE-2023-38884 affects the Community Edition (openSIS Classic) v9.0. The issue is an Insecure Direct Object Reference (IDOR) that allows an unauthenticated remote attacker to access any student’s files by visiting a direct file URL under /assets/studentfiles/-. The vulnerability stems from insuff...

CVE-2023-38882

A reflected cross-site scripting XSS vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'...

Open Solutions For Education openSIS Security Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education. A security vulnerability exists in Open Solutions For Education openSIS Classic Community Edition v9.0, which stems from a directory traversal vulnerability that allows...

CVE-2023-38879

The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'...

CVE-2023-38883

CVE-2023-38883 describes a reflected cross-site scripting (XSS) vulnerability in the Open Solutions For Education (OS4ED) openSIS Classic Community Edition v9.0 . The issue affects the web application through the parameter 'ajax' in ParentLookup.php , allowing remote attackers to cause the browse...

Open Solutions For Education openSIS Security Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, Inc. A security vulnerability exists in Open Solutions For Education openSIS Classic Community Edition v9.0, which originates from a Reflective Cross-Site Scripting XSS...

CVE-2023-38881

CVE-2023-38881 describes a reflected XSS in OS4ED’s openSIS Classic Community Edition v9.0. The vulnerability lies in how CalendarModal.php accepts four input parameters—calendar_id, school_date, month, and year—enabling remote attackers to inject and execute arbitrary JavaScript in a user’s brow...

CVE-2022-45962

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php...

Sql injection

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php...

CVE-2022-45962

The CVE-2022-45962 entry concerns Open Solutions for Education OpenSIS Community Edition (v8.0 and earlier) vulnerable to SQL Injection via CalendarModal.php. The vulnerability is described as a SQL injection on a PHP calendar modal component, with CVSSv3.1 base impact: High confidentiality impac...

Open Solutions For Education openSIS SQL注入漏洞

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions for Education openSIS Community Edition v8.0 and earlier versions, which originates from a SQL injection...

CVE-2022-45962

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php...

CVE-2022-45962

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php...

CVE-2022-45962

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php...

Authenticated SQL Injection in OpenSIS Classic v9.0 and earlier

Description SQL injection in OpenSIS Classic v9.0 and earlier allows remote authenticated attackers to execute SQL code via the id parameter in MassScheduleModal.php leading to full database information disclosure. Version At the time of reporting, the most up-to-date version of the master branch...

The vulnerability of the information system openSIS, related to the failure to protect the SQL query structure, allows a perpetrator to execute arbitrary SQL queries.

The vulnerability of the information system openSIS is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries through the parameter /opensis/modules/users/Staff.php, Staff TITLE...