CVE-2020-6130: SQL Injection
Published Sep 1, 2020
·Updated
SQL injection vulnerabilities exist in the courseperiodid parameters used in OS4Ed openSIS 7.3 pages. The courseperiodid parameter in the page MassDropSessionSet.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.
Affected Software
1 affected component
OS4ED openSIS=7.3
Event History
Sep 1, 2020
CVE Published
via MITRE·01:07 PM
Data Sourced
via MITRE·01:07 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this SQL injection vulnerability?
The vulnerability ID for this SQL injection vulnerability is CVE-2020-6130.
2
What is the affected software version?
The affected software version is OpenSIS 7.3.
3
How severe is the vulnerability?
The severity of this vulnerability is high with a CVSS score of 8.8.
4
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following link: [CVE-2020-6130](https://talosintelligence.com/vulnerability_reports/TALOS-2020-1076).
5
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-89.