Vulnerability Spotlight: Multiple SQL, code injection vulnerabilities in OpenSIS

Summary: Cisco Talos researchers Yuri Kramarz and Yves Younan discovered multiple SQL injection and remote code execution vulnerabilities in the OpenSIS student information system used by K-12 schools, spanning advisories TALOS-2020-1072 through TALOS-2020-1083 and CVEs CVE-2020-6117 through CVE-2020-6144. Most flaws in openSIS 7.3 require an authenticated HTTP request, while the password reset and login SQL injection issues can be triggered by sending an HTTP request, and the Modules.php flaws in versions 7.3 and 7.4 can lead to local file inclusion and remote code execution.
Bottom line: These bugs sit in the system schools use to track attendance, grades and transcripts, and the login and password reset flaws need no authentication, so the records of K-12 students are the stake. Talos confirmed the issues and published Snort rules 54123-54144, 54251-54264 and 54267-54269, but detection only helps if the update is applied.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-6117 CVE-2020-6122 CVE-2020-6123 CVE-2020-6125 CVE-2020-6126 CVE-2020-6129 CVE-2020-6132 CVE-2020-6135 CVE-2020-6136
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026