CVE-2020-13381: openSIS SQL injection in versions through 7.4

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit references, and a very high EPSS score make this an urgent exposure for any internet-facing openSIS deployment.

What it is

openSIS through 7.4 is affected by SQL injection (CWE-89). The flaw is remotely reachable without authentication or user interaction, and the record does not identify the specific vulnerable parameter or file. Because openSIS handles student and staff records, a successful injection can expose or alter sensitive data.

Impact

An unauthenticated attacker can read, modify, or delete database contents, including student and staff records, and may be able to execute code on the underlying host depending on database privileges.

Attack surface

Reachable over the network via HTTP against the openSIS web application; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required. The record does not name the vulnerable endpoint or parameter.

Exploitation

Not listed in CISA KEV, but EPSS is 0.59028 (99th percentile) and Packet Storm references are tagged Exploit, including an unauthenticated PHP code execution write-up, indicating public exploit material exists.

What to do

• Apply the vendor fix from the openSIS-Responsive-Design commit history or upgrade past 7.4; the record does not specify a fixed version.
• If patching is not immediately possible, restrict network access to the openSIS instance to trusted users and place it behind authentication or a VPN.
• Review and harden database account privileges used by the application to limit read/write scope and remove unnecessary file or command execution rights.
• Deploy a WAF with SQL injection rules in front of the application as a temporary compensating control.
• Audit openSIS configuration and exposed endpoints for unauthenticated access paths.

Detection

• Monitor web server and WAF logs for SQL injection patterns (UNION, OR 1=1, stacked queries, comment sequences) in requests to openSIS paths.
• Alert on database errors or unusual query volume originating from the web application account.
• Baseline and monitor outbound connections or file writes from the database host for signs of post-exploitation activity.
• Review authentication logs for anomalous access to openSIS endpoints from unexpected source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.