CVE-2020-6144 CRITICAL

CVE-2020-6144

Vendor N/A
Product OS4Ed
Weakness CWE-96
Published September 1, 2020
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.

Key dates

02Disclosure timeline

September 1, 2020 CVE published
August 4, 2024 Record updated