CVE-2024-35584
Published: 15 October 2024
Summary
CVE-2024-35584 is a high-severity SQL Injection (CWE-89) vulnerability in Os4Ed Opensis. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Credential Access (T1212); ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
SQL injection vulnerabilities affect OpenSis Community Edition versions 9.1 through 8.0 and possibly earlier releases. The flaws reside in Ajax.php, ForWindow.php, ForExport.php, Modules.php, and functions/HackingLogFnc.php, where the application accepts an arbitrary value from the X-Forwarded-For header and concatenates it directly into a SQL INSERT statement without sanitization.
An authenticated user can exploit the issue over the network by supplying a crafted X-Forwarded-For header in requests to the affected endpoints. Successful injection grants the attacker the ability to read, modify, or delete arbitrary database contents, corresponding to the CVSS 8.8 rating that reflects high impact on confidentiality, integrity, and availability.
The provided references point to the vendor sites opensis.com and os4ed.com along with a public proof-of-concept repository, but contain no explicit statements on patches or mitigation steps. The associated EPSS score has remained stable at its peak value of 0.8517 with no indicated rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-35382
Vulnerability details
SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The…
more
application takes arbitrary value from "X-Forwarded-For" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in multiple PHP files allows authenticated attackers to execute arbitrary SQL queries via the unsanitized X-Forwarded-For header in logging functions, enabling exploitation for credential access from the database (T1212) and collection of data from information repositories such as databases (T1213.006).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.