CVE-2022-45962

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 45%
VendorProductVersion
os4edopensis
𝑥
≤ 8.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://ccat.gitbook.io/cyber-sec/cve/cve-2022-45962-postauth-sqli
https://github.com/OS4ED/openSIS-Classic
https://github.com/OS4ED/openSIS-Classic/blob/381a1ad907285182c88e30b8bb6ce91123d9275d/CalendarModal.php#L30
https://github.com/OS4ED/openSIS-Classic/commit/81799fd1de74d7b4bf3c4c37ad6042214e48a469
https://github.com/OS4ED/openSIS-Classic/commit/81799fd1de74d7b4bf3c4c37ad6042214e48a469#diff-06a8cd9b045bb97531de5ba5122272ffdd519a78b1daa12060e12e337c8d2016
https://ccat.gitbook.io/cyber-sec/cve/cve-2022-45962-postauth-sqli
https://github.com/OS4ED/openSIS-Classic
https://github.com/OS4ED/openSIS-Classic/blob/381a1ad907285182c88e30b8bb6ce91123d9275d/CalendarModal.php#L30
https://github.com/OS4ED/openSIS-Classic/commit/81799fd1de74d7b4bf3c4c37ad6042214e48a469
https://github.com/OS4ED/openSIS-Classic/commit/81799fd1de74d7b4bf3c4c37ad6042214e48a469#diff-06a8cd9b045bb97531de5ba5122272ffdd519a78b1daa12060e12e337c8d2016