Cyber Resilience

CVE-2024-51211

CriticalPublic PoC

Published: 08 November 2024

Published
08 November 2024
Modified
17 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0406 88.8th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-51211 is a critical-severity SQL Injection (CWE-89) vulnerability in Os4Ed Opensis. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A SQL injection vulnerability tracked as CVE-2024-51211 affects OS4ED openSIS-Classic version 9.1, specifically within the resetuserinfo.php file. The issue arises from insufficient input validation on the $username_stn_id parameter, which permits injection of arbitrary SQL commands and is assigned CWE-89 with a CVSS 3.1 base score of 9.8.

Unauthenticated remote attackers can exploit the flaw over the network without credentials or user interaction, enabling them to read, modify, or delete database contents and potentially achieve full control over the confidentiality, integrity, and availability of the application and its underlying data.

The single reference URL points to a GitHub repository that documents the vulnerability but provides no official advisory details, patch information, or mitigation guidance.

The associated EPSS score rose from lower values to a peak of 0.0657 on 2025-12-11 before receding to the current 0.0406, indicating a modest post-disclosure increase in exploitation interest that has since subsided.

EU & UK References

Vulnerability details

SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in web application resetuserinfo.php enables exploitation of public-facing applications (T1190) and arbitrary data collection from databases (T1213.006).

Affected Assets

os4ed
opensis
9.0, 9.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References