CVE-2021-41677: SQL Injection

Published Nov 30, 2021

Updated

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/functions/GetStuListFnc.php &Grade= parameter.

Affected Software

1 affected component

OS4ED openSIS=8.0

Event History

Nov 30, 2021

CVE Published

via MITRE·12:59 PM

Data Sourced

via MITRE·12:59 PM

Description

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-41677?

CVE-2021-41677 is a SQL injection vulnerability in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.

What is the severity of CVE-2021-41677?

CVE-2021-41677 has a severity rating of 9.8 out of 10, indicating a critical vulnerability.

How does CVE-2021-41677 affect openSIS?

CVE-2021-41677 allows an attacker to issue SQL commands through the /opensis/functions/GetStuListFnc.php &Grade= parameter, potentially leading to unauthorized access or manipulation of the application database.

Which software versions are affected by CVE-2021-41677?

Version 8.0 of openSIS is affected by CVE-2021-41677 when MySQL or MariaDB is used as the application database.

Is there a fix for CVE-2021-41677?

Yes, OS4Ed has released a fix for CVE-2021-41677. It is recommended to update to the latest version of openSIS to mitigate the risk.