CVE-2020-6140

CRITICAL

OS4Ed openSIS 7.3 - SQL Injection via Password Reset Page

Title source: llm

Description

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1080

Scores

CVSS v3 9.8

EPSS 0.0263

EPSS Percentile 83.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

os4ed/opensis 7.3

Published Sep 01, 2020

Tracked Since Feb 18, 2026