CVE-2020-6143: Code Injection

Published Sep 1, 2020

Updated

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.

Affected Software

1 affected component

OS4ED openSIS=7.4

Event History

Sep 1, 2020

CVE Published

via MITRE·08:15 PM

Data Sourced

via MITRE·08:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-6143?

CVE-2020-6143 is a remote code execution vulnerability in the install functionality of OS4Ed openSIS 7.4.

What is the severity of CVE-2020-6143?

CVE-2020-6143 has a severity rating of 9.8 (Critical).

How does CVE-2020-6143 work?

CVE-2020-6143 allows for injection of PHP code into the Data.php file through a password variable in install/Step5.php.

Which software version is affected by CVE-2020-6143?

OS4Ed OpenSIS version 7.4 is affected by CVE-2020-6143.

Is there a fix for CVE-2020-6143?

A patch or update may be available to fix CVE-2020-6143, check with the OS4Ed OpenSIS vendor for the latest information.