by Kastro
Paper/Archive/CVE-2020-6144

CVE-2020-6144

talos — A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4.

EPSS 6%CVSS 10.0
critical.is priorityof 100
49
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 93.5.935 × 2018.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
OS4EdOS4Ed openSIS 7.4–CNA

Scores by source

talos (CNA)10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2020-1083