Open Solutions For Education openSIS SQL注入漏洞

openSIS is a free and open source student information system/school management software. openSIS version 8.0 is vulnerable to SQL injection when using MySQL MariaDB as the application database. The vulnerability can be exploited to issue SQL commands to the MySQL MariaDB database via the...

Exploit for SQL Injection in Os4Ed Opensis

CVE-2021-40353 CVE-2021-40353 openSIS 8.0 SQL Injection Vulner...

Path Traversal in os4ed/opensis-classic

✍️ Description The module.php modname parameter in OpenSIS 8.0 is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.; 🕵️‍♂️ Proof of Concept // Modules.php GET /Modules.php?modname=../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1 302...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

Design/Logic Flaw

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

Cross site scripting

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27408

OpenSIS Community Edition up to version 7.6 is affected by an access-control flaw in ResetUserInfo.php that lets an unauthenticated attacker change arbitrary user passwords. The root cause is improper access controls on the ResetUserInfo.php endpoint, enabling password modification without authen...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter. The issue is consistently described across connected sources as CVE-2020-27409. No explicit exploit details or patch version are provided in the connecte...

OpenSIS Community Edition Cross-Site Scripting Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions for Education Open Solutions For Education. A cross-site scripting vulnerability exists in OpenSIS Community Edition versions prior to 7.5, which stems from being affected by the...

Open Solutions For Education openSIS Encryption Problem Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions for Education OSE. A vulnerability exists in OpenSIS Community Edition version 7.6 and prior versions due to an encryption issue that originates from incorrect access controls in the...

OpenSIS SQL Injection (CVE-2020-6637; CVE-2020-6137; CVE-2020-6138; CVE-2020-6139; CVE-2020-6140; CVE-2020-6141)

An SQL injection vulnerability exists in OpenSIS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

openSIS SQL Injection Vulnerability (CNVD-2020-50948)

openSIS is a free, open source student information system/school management software. An SQL injection vulnerability exists in the id parameter in CourseMoreInfo.php in OS4Ed openSIS 7.3, which can be exploited by an attacker sending an HTTP request to conduct an SQL injection attack...

openSIS SQL Injection Vulnerability (CNVD-2020-52047)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the id parameter in CoursePeriodModal.php in openSIS 7.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection attack...

openSIS SQL Injection Vulnerability (CNVD-2020-50531)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the fn parameter in CheckDuplicateStudent.php in openSIS 7.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection attack...

openSIS SQL Injection Vulnerability (CNVD-2020-50947)

openSIS is a free, open source student information system/school management software. An SQL injection vulnerability exists in the id parameter in ChooseCP.php in OS4Ed openSIS 7.3, which can be exploited by an attacker sending an HTTP request to conduct an SQL injection attack...