PT-2020-18942
CVE-2020-6128
·
تاريخ النشر
2020-09-01
·
تاريخ التحديث
2022-05-31
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
OS4Ed openSIS version 7.3
Description
A SQL injection issue exists in the CoursePeriodModal.php page. This can be triggered by a specially crafted HTTP request, allowing an attacker to exploit the
meet date parameter in the CoursePeriodModal.php page for SQL injection. An authenticated HTTP request can be used to trigger this issue.Recommendations
For OS4Ed openSIS version 7.3, consider restricting access to the CoursePeriodModal.php page until a fix is available, and avoid using the
meet date parameter in this page to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾