CVE-2020-6118: SQL Injection
Published Sep 1, 2020
·Updated
SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The bmonth parameter in the page CheckDuplicateStudent.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Affected Software
1 affected component
OS4ED openSIS=7.3
Event History
Sep 1, 2020
CVE Published
via MITRE·01:51 PM
Data Sourced
via MITRE·01:51 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-6118.
2
What is the severity of CVE-2020-6118?
CVE-2020-6118 has a severity rating of 8.8 (high).
3
Which software version is affected by CVE-2020-6118?
CVE-2020-6118 affects OS4Ed OpenSIS version 7.3.
4
Which page in OS4Ed OpenSIS is vulnerable to SQL injection?
The CheckDuplicateStudent.php page in OS4Ed OpenSIS is vulnerable to SQL injection.
5
How can an attacker exploit CVE-2020-6118?
An attacker can exploit CVE-2020-6118 by making an authenticated HTTP request with a malicious input in the bmonth parameter of the CheckDuplicateStudent.php page.