CVE-2021-40353: SQL Injection
Published Sep 1, 2021
·Updated
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637.
Affected Software
1 affected component
OS4ED openSIS=8.0
Event History
Sep 1, 2021
CVE Published
via MITRE·12:15 AM
Data Sourced
via MITRE·12:15 AM
Description
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-40353.
2
What is the severity of CVE-2021-40353?
CVE-2021-40353 has a severity rating of 9.8 (critical).
3
What is the affected software for CVE-2021-40353?
The affected software for CVE-2021-40353 is OpenSIS version 8.0.
4
What is the description of CVE-2021-40353?
CVE-2021-40353 is a SQL injection vulnerability in OpenSIS version 8.0 when MySQL or MariaDB is used as the application database.
5
How can an attacker exploit CVE-2021-40353?
An attacker can exploit CVE-2021-40353 by issuing a SQL command through the index.php USERNAME parameter.