CVE-2020-6142

OS4Ed openSIS 7.3 is affected by CVE-2020-6142 through a local file inclusion in the Modules.php functionality. A vulnerability in the modname parameter allows an attacker to include arbitrary files via directory traversal and potentially execute remote PHP code. The weakness is exploitable via c...

CVE-2020-6142

A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cause local file inclusion. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6140

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6140

CVE-2020-6140 affects OS4Ed openSIS 7.3. Multiple SQL injection vulnerabilities exist in the password reset flow (ResetUserInfo.php) via parameters such as password_stf_email , uname , and username_stf_email . Root cause described as lack of input sanitization in the reset logic, enabling arbitra...

CVE-2020-6139

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The usernamestfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6139

CVE-2020-6139 affects OS4Ed openSIS 7.3. The password reset flow in ResetUserInfo.php is vulnerable to SQL injection via multiple inputs (e.g., password_stf_email, uname, username_stf_email, username_stn_id) due to unescaped user data embedded in SQL queries. Exploitation could allow retrieving o...

CVE-2020-6138

OS4Ed openSIS 7.3 contains multiple SQL injection vulnerabilities in the password reset flow. The uname parameter on /opensis/ResetUserInfo.php (and related fields) can be exploited to run arbitrary SQL, potentially exposing usernames, emails, and other data. Attackers could trigger via crafted H...

CVE-2020-6138

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6137

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6137

CVE-2020-6137 affects OS4Ed openSIS 7.3 and is a SQL injection in the password reset feature. The vulnerability occurs in ResetUserInfo.php via parameters such as password_stf_email, uname, and related fields, due to insufficient input sanitization, enabling an attacker to craft HTTP requests to ...

CVE-2020-6136

An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-6141

An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6136

An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-6141

An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6141

An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6141

OS4Ed openSIS 7.3 is affected by a SQL injection in the login path. The vulnerability arises from unsanitized input used in a login query (USERNAME/PASSWORD), specifically the code path that builds a SQL statement in opensis/index.php (line 117) without proper escaping. TALOS details confirm a hi...

CVE-2020-6135

An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-6135

An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...