CVE-2020-6131: SQL Injection
Published Sep 1, 2020
·Updated
SQL injection vulnerabilities exist in the courseperiodid parameters used in OS4Ed openSIS 7.3 pages. The courseperiodid parameter in the page MassScheduleSessionSet.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.
Affected Software
1 affected component
OS4ED openSIS=7.3
Event History
Sep 1, 2020
CVE Published
via MITRE·01:07 PM
Data Sourced
via MITRE·01:07 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2020-6131?
CVE-2020-6131 is a SQL injection vulnerability in the course_period_id parameters used in OS4Ed openSIS 7.3 pages.
2
How severe is CVE-2020-6131?
CVE-2020-6131 has a severity rating of 8.8, which is considered high.
3
What software is affected by CVE-2020-6131?
OS4Ed OpenSIS version 7.3 is affected by CVE-2020-6131.
4
How can an attacker exploit CVE-2020-6131?
An attacker can exploit CVE-2020-6131 by making an authenticated HTTP request with a malicious course_period_id parameter.
5
Is there a fix available for CVE-2020-6131?
Yes, it is recommended to update to a version of OS4Ed OpenSIS that is not affected by CVE-2020-6131.