CVE-2021-40309

Katalog CVE

CVSS 8.8 · High EPSS 1,8%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada os4ed opensis. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cp_id_miss_attn parameter from TakeAttendance.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request as a user with access to "Take Attendance" functionality to trigger this vulnerability.

Rincian

Terbit di NVD

24 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md exploit · advisory pihak ketiga
• https://github.com/OS4ED/openSIS-Classic product · advisory pihak ketiga
• https://www.exploit-db.com/exploits/50249 exploit · advisory pihak ketiga · vdb entry