OpenSIS "USERNAME" SQL Injection Vulnerability

OpenSIS "USERNAME" SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
Opensis 4.x
Description:
CVE (CAN) ID: CVE-2014-8366

OpenSIS is an open-source student information system.

OpenSIS 4.5-5.3 has the SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands by passing parameters to the username and password in index. php.

<* Source: Ubani Anthony Balogun

Link: http://secunia.com/advisories/59114
*>

Suggestion:
Vendor patch:

Opensis
-------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.opensis.com/

This article permanently updates the link address: