PT-2024-26561 · Unknown · Opensis Community Edition

Whwhwh96 · Published 2024-10-15 · Updated 2025-07-17 · CVE-2024-35584

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSis Community Edition versions 8.0 through 9.1

Description The issue is related to SQL injection due to a lack of sanitization. An authenticated user can perform SQL injection because the application directly appends an arbitrary value from the X-Forwarded-For header to a SQL INSERT statement. This allows for potential manipulation of database queries.

Recommendations For OpenSis Community Edition versions 8.0 through 9.1, consider disabling the affected PHP files (Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php) until a patch is available to prevent SQL injection attacks. Restrict access to these files to minimize the risk of exploitation. Avoid using the X-Forwarded-For header in SQL statements until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-35584

Affected Products

Opensis Community Edition

References · 8

• 🔥 https://github.com/whwhwh96/CVE-2024-35584 · Exploit
• https://osv.dev/vulnerability/CVE-2024-35584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35584 · Security Note
• https://twitter.com/CVEnew/status/1846261091313045639 · Twitter Post
• http://os4ed.com · Note
• https://t.me/cvedetector/7941 · Telegram Post
• http://opensis.com · Note
• https://t.me/cvenotify/129324 · Telegram Post