CVE-2020-6140: SQL Injection

Published Sep 1, 2020

Updated

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

Affected Software

1 affected component

OS4ED openSIS=7.3

Event History

Sep 1, 2020

CVE Published

via MITRE·08:04 PM

Data Sourced

via MITRE·08:04 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID is CVE-2020-6140.

What is the severity of CVE-2020-6140?

The severity of CVE-2020-6140 is critical with a CVSS score of 9.8.

How does the SQL injection vulnerability in CVE-2020-6140 work?

The SQL injection vulnerability in CVE-2020-6140 allows an attacker to inject malicious SQL code into the password_stf_email parameter of the /opensis/ResetUserInfo.php page, potentially enabling them to execute unauthorized database queries.

What is the affected software version of CVE-2020-6140?

The affected software version of CVE-2020-6140 is OS4Ed OpenSIS 7.3.

Is there a patch or fix available for CVE-2020-6140?

Currently, there is no specific patch or fix available for CVE-2020-6140. It is recommended to follow the vendor's recommendations and security best practices to mitigate the risk.