Unscored CVE-2021-41677 EUVD-2021-28689GHSA-cvj9-h36c-4whf

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can t…

Published Nov 30, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/functions/GetStuListFnc.php &Grade= parameter.

References

https://github.com/OS4ED/openSIS-Classic/issues/202