Lucene search

MitreCVE-2022-45962

HistoryFeb 13, 2023 - 9:15 p.m.

CVE-2022-45962

2023-02-1321:15:13

CWE-89

mitre

web.nvd.nist.gov

cve

2022

45962

open solutions

education

inc

opensis

community edition

sql injection

calendarmodal.php

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

58.3%

JSON

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php.

Affected configurations

Nvd

Node

os4edopensisRange≤8.0community

VendorProductVersionCPE
os4edopensis*cpe:2.3:a:os4ed:opensis:*:*:*:*:community:*:*:*

Vendor	Product	Version	CPE
os4ed	opensis	*	cpe:2.3:a:os4ed:opensis:::::community:::*

References

ccat.gitbook.io/cyber-sec/cve/cve-2022-45962-postauth-sqli

github.com/OS4ED/openSIS-Classic

github.com/OS4ED/openSIS-Classic/blob/381a1ad907285182c88e30b8bb6ce91123d9275d/CalendarModal.php#L30

github.com/OS4ED/openSIS-Classic/commit/81799fd1de74d7b4bf3c4c37ad6042214e48a469

github.com/OS4ED/openSIS-Classic/commit/81799fd1de74d7b4bf3c4c37ad6042214e48a469#diff-06a8cd9b045bb97531de5ba5122272ffdd519a78b1daa12060e12e337c8d2016

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

58.3%

JSON

Related for CVE-2022-45962