Threats tagged 'ghsa-3697-v58m-hrx3'

A SQL injection vulnerability exists in OS4ED openSIS-Classic up to version 9.3 in the DBQuery_assignment function within the Assignment Management Endpoint. This vulnerability allows remote attackers with low privileges to manipulate the 'Tables' argument to execute SQL injection attacks. The vulnerability has a CVSS 3.1 score of 6.3, indicating a medium severity impact on confidentiality, integrity, and availability. The project has been notified but has not yet responded or issued a fix. Exploit code is publicly available, but no active exploitation in the wild has been reported.