CVE-2020-6136

An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Score

CVSS 3.1 8.8 High

Status

Modified - talos-cna@cisco.com

Published

2020-09-01

Last modified

2024-08-04

Weaknesses

CWE-89

Affected products

• Opensis (Os4ed)

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1079