PT-2020-18958
CVE-2020-6144
·
تاريخ النشر
2020-09-01
·
تاريخ التحديث
2022-05-31
الوصف من
CVSS 3.1
10
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
OS4Ed openSIS version 7.4
Description
A remote code execution issue exists in the install functionality. The
username variable, set at line 121 in install/Step5.php, allows for injection of PHP code into the Data.php file. An attacker can send an HTTP request to trigger this issue.Recommendations
For OS4Ed openSIS version 7.4, consider restricting access to the install functionality until a fix is available. As a temporary workaround, avoid using the
username variable in the affected install/Step5.php file to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾