openSIS-Classic vulnerabilities
3 known vulnerabilities in openSIS-Classic from Os4ed. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.3 Critical severity
openSIS-Classic: Authorization Bypass Through User-Controlled Key
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
- 7.1 High severity
openSIS-Classic: Authorization Bypass Through User-Controlled Key
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary ma
- 9.8 Critical severity
opensis-classic: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbi