PT-2020-18950

CVE-2020-6136

·

Published

2020-09-01

·

Updated

2022-05-31

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions openSIS version 7.3
Description An exploitable SQL injection issue exists in the DownloadWindow.php functionality. A specially crafted HTTP request can lead to SQL injection, allowing an attacker to trigger this issue with an authenticated HTTP request.
Recommendations For openSIS version 7.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2020-6136
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com