openSIS SQL Injection Vulnerability (CNVD-2020-50955)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the usernamestfemail parameter in the password reset page /opensis/ResetUserInfo.php in OS4Ed openSIS 7.3, which can be exploited by an attacker to obtain information by...

PT-2020-18953

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the password reset functionality. The username stf email parameter in the "/opensis/ResetUserInfo.php" API endpoint is vulnerable to SQL injection, allowing an attacker to...