Vulnerability · Published Sep 1, 2021 · Assigned by mitre

CVE-2021-40353

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.9%top 13.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.opensis.com/download/english x_refsource_MISC
https://github.com/5qu1n7/CVE-2021-40353 x_refsource_MISC