CVE-2021-41691

An attacker sends a malicious HTTP POST request to the /TransferredOutModal.php endpoint, injecting unsafe SQL expressions in the 'student_id' and 'TRANSFER[SCHOOL]' parameters. User-supplied data is not properly validated or parameterized before being passed to the database query. This allows modification of the logic of SQL queries executed by the application, leading to unauthorized access or data manipulation in the database.

An attacker can obtain unauthorized read, modification, or deletion of data from the system's database, including sensitive student and employee data. Depending on the database server configuration, it is also possible to execute system commands or gain complete control over the application.

Apply patches available from the manufacturer according to references. Additionally, it is recommended to restrict network access to the /TransferredOutModal.php endpoint at the firewall or WAF level and monitor application logs for suspicious POST requests to this resource.

OS4Ed OpenSIS Community v8.0