Code Injection in openSIS - CVE-2013-1349
Published: December 9, 2013 / Updated: September 9, 2020
Vulnerability identifier: #VU46335
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-1349
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.
Affected software
openSIS
How to mitigate CVE-2013-1349
Install update from vendor's website.