CVE-2021-41678: SQL Injection

Published Nov 30, 2021

Updated

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/users/Staff.php, staff{TITLE] parameter.

Affected Software

1 affected component

OS4ED openSIS=8.0

Event History

Nov 30, 2021

CVE Published

via MITRE·01:07 PM

Data Sourced

via MITRE·01:07 PM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-41678?

CVE-2021-41678 is a SQL injection vulnerability in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.

How does CVE-2021-41678 affect openSIS?

CVE-2021-41678 allows an attacker to issue SQL commands through the /opensis/modules/users/Staff.php, staff{TITLE] parameter.

What is the severity of CVE-2021-41678?

CVE-2021-41678 has a severity score of 9.8 out of 10, making it a critical vulnerability.

Which software versions are affected by CVE-2021-41678?

Version 8.0 of openSIS is affected by CVE-2021-41678.

How can I fix CVE-2021-41678?

To fix CVE-2021-41678, update openSIS to a version that has the vulnerability patched. Please refer to the official documentation or vendor website for the patch.