Unscored severity · published Dec 9, 2013
CVE-2013-1349
Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter
–
CVSS
21.9%
EPSS
No
On KEV
Description
Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)21.9% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensis · Os4ed
4.5; 4.6; 4.7; 4.8; 4.8.1; 4.9; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1349
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1349
Exploit
http://karmainsecurity.com/KIS-2013-10
Vendor Advisory
http://secunia.com/advisories/55913
Exploit
http://sourceforge.net/p/opensis-ce/bugs/59/
Exploit
http://sourceforge.net/p/opensis-ce/code/1009
More from Opensis
9.8
CVE-2021-41691
A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to…
9.8
CVE-2025-22930
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php
9.8
CVE-2025-22928
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php
9.8
CVE-2025-22926
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to…
9.8
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php