CVE-2021-40618: SQL Injection

Published Oct 12, 2021

Updated

An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDRCONTUSRN, 2) ADDRCONTPSWD, 3) SECNCONTUSRN or 4) SECNCONTPSWD parameters in HoldAddressFields.php.

Affected Software

1 affected component

OS4ED openSIS=8.0

Event History

Oct 12, 2021

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-40618?

CVE-2021-40618 is an SQL Injection vulnerability that exists in openSIS Classic 8.0.

How does the SQL Injection vulnerability in CVE-2021-40618 work?

The SQL Injection vulnerability in CVE-2021-40618 can be exploited through the ADDR_CONT_USRN, ADDR_CONT_PSWD, SECN_CONT_USRN, or SECN_CONT_PSWD parameters in HoldAddressFields.php.

What is the severity of CVE-2021-40618?

CVE-2021-40618 has a severity rating of 9.8 (critical).

How can I fix the SQL Injection vulnerability in CVE-2021-40618?

To fix the SQL Injection vulnerability in CVE-2021-40618, it is recommended to update to a version of openSIS Classic that is not affected by this vulnerability or apply the necessary patches provided by the vendor.

Where can I find more information about CVE-2021-40618?

More information about CVE-2021-40618 can be found at the following reference: [link](https://github.com/OS4ED/openSIS-Classic/issues/193)