PT-2020-18958 · Os4Ed · Opensis

Published 2020-09-01 · Updated 2022-05-31 · CVE-2020-6144

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.4

Description A remote code execution issue exists in the install functionality. The username variable, set at line 121 in install/Step5.php, allows for injection of PHP code into the Data.php file. An attacker can send an HTTP request to trigger this issue.

Recommendations For OS4Ed openSIS version 7.4, consider restricting access to the install functionality until a fix is available. As a temporary workaround, avoid using the username variable in the affected install/Step5.php file to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-96

Related Identifiers

CVE-2020-6144

Affected Products

Opensis

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1083 · Exploit
• https://osv.dev/vulnerability/CVE-2020-6144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6144 · Security Note