CVE-2024-35584

HIGHNuclei

openSIS < 9.1 - SQL Injection

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-35584 has a selected CVSS score of 8.8 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from "X-Forwarded-For" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 16, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

opensis

Browse opensis / opensis

Default status: unknown

CVE List9.1affected
8.0affected

Proofs of concept

1

Repository PoCs

GitHubwhwhwh96/CVE-2024-35584Repository PoCby whwhwh961Not analyzed1 file

2.5 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHopenSIS < 9.1 - SQL InjectionCVSS 8.8

SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1, 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from "X-Forwarded-For" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.

Impact

Authenticated attackers can perform SQL injection via the X-Forwarded-For header, potentially extracting or modifying sensitive database information.

Remediation

Update openSIS to a version later than 9.1 that patches the SQL injection vulnerability.

WeaknessesCWE-89
Authorss4e-io
Template tagscvecve2024opensisauthenticatedsqlivuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Shodan: http.title:"opensis"
FOFA: title="opensis"
Google: intitle:"opensis"
https://www.tenable.com/cve/CVE-2024-35584 https://vuldb.com/?id.280406 https://github.com/whwhwh96/CVE-2024-35584 https://github.com/OS4ED/openSIS-Classic http://opensis.com/ https://nvd.nist.gov/vuln/detail/CVE-2024-35584

Source: ProjectDiscovery

References

4