Back to overview

CVE-2020-6143

CRITICAL
10.0
CVSS 3.0
Description
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.

Metadata

CVE ID
CVE-2020-6143
State
PUBLISHED
Assigner
talos
Reserved
2020-01-07 00:00 UTC
Published
2020-09-01 20:15 UTC
Last updated
2024-08-04 08:55 UTC
Primary CWE
CWE-96
CWE-96: Improper Neutralization of Directives in Statically …
Vendor / Product
n/a / OS4Ed
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products (1)
VendorProductPlatformVersions
n/a OS4Ed — OS4Ed openSIS 7.4
Weakness (CWE)
CWESourceDescription
CWE-96 cna CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.0 cna CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview