CVE-2021-40309

A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cp_id_miss_attn parameter from TakeAttendance.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request as a user with access to "Take Attendance" functionality to trigger this vulnerability.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.82% chance of exploitation in the next 30 days, 77th percentile

Published

2021-09-24

Updated

2024-08-04

Proof-of-concept exploits (2)

• MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md
• https://www.exploit-db.com/exploits/50249

References

• CVE Record
• NVD entry

Related

• CVE-2021-40310
• CVE-2021-40651
• CVE-2021-40303
• CVE-2021-40292
• CVE-2021-4032
• CVE-2021-40285