---
cve: "CVE-2020-6144"
severity: "CRITICAL"
cvss: 10.0
epss: "6.2%"
vendor: "n/a"
kev: false
exploited: false
published: "2020-09-01 21:15:13"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-05T14:21:56+01:00"
---

# CVE-2020-6144

> 10.0 CRITICAL

## Beschreibung

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.

## CNA-Record (Kanon, cvelistV5)

- CNA: **talos**
- State: PUBLISHED
- Stand: 2024-08-04 08:55:21
- CNA-CVSS: **10.0** (`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`)

## CVSS-Vektor

```
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-96** — Improper Neutralization of Directives in Statically Saved Code
  The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

## Angriffsmuster (CAPEC)

- [CAPEC-35 — Leverage Executable Code in Non-Executable Files](https://capec.mitre.org/data/definitions/35.html) _(Severity: Very High)_
- [CAPEC-73 — User-Controlled Filename](https://capec.mitre.org/data/definitions/73.html) _(Severity: High)_
- [CAPEC-77 — Manipulating User-Controlled Variables](https://capec.mitre.org/data/definitions/77.html) _(Severity: Very High)_
- [CAPEC-81 — Web Server Logs Tampering](https://capec.mitre.org/data/definitions/81.html) _(Severity: High)_
- [CAPEC-85 — AJAX Footprinting](https://capec.mitre.org/data/definitions/85.html) _(Severity: Low)_

## ATT&CK-Techniken

- [T1027.006 — Obfuscated Files or Information: HTML Smuggling](https://attack.mitre.org/techniques/T1027/006/)
- [T1027.009 — Obfuscated Files or Information: Embedded Payloads](https://attack.mitre.org/techniques/T1027/009/)
- [T1564.009 — Hide Artifacts: Resource Forking](https://attack.mitre.org/techniques/T1564/009/)

## Referenzen

- <https://talosintelligence.com/vulnerability_reports/TALOS-2020-1083>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2020-6144/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_