CVE-2020-6133

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3

Description The issue concerns SQL injection vulnerabilities found in the ID parameters of certain pages. Specifically, the id parameter in the CourseMoreInfo.php page is vulnerable to SQL injection. An attacker can exploit this by making an authenticated HTTP request.

Recommendations For OS4Ed openSIS version 7.3, consider restricting access to the CourseMoreInfo.php page until a fix is available, and avoid using the id parameter in this page to minimize the risk of exploitation.