Skip to content
Threat Feed
Subscribe
high advisory

OpenSIS Community Edition: Authenticated SQL Injection (CVE-2024-35584)

An authenticated SQL injection vulnerability in OpenSIS Community Edition 8.0-9.1 allows attackers to execute arbitrary SQL commands via unsanitized X-Forwarded-For headers.

CVE search metadata

CVE search record: CVE-2024-35584. Severity: high. CVSS: 8.8. EPSS: 5.86%. KEV: no. Product: OpenSIS Community Edition (8.0 - 9.1). Brief: OpenSIS Community Edition: Authenticated SQL Injection (CVE-2024-35584). Brief link: https://feed.craftedsignal.io/briefs/2026-10-opensis-sql-injection/

Triage facts

Revision 1
Applicability
OpenSIS Community Edition (8.0 - 9.1)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 24, 04:05 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B3Likely

OpenSIS Community Edition versions 8.0 through 9.1 contain an authenticated SQL injection vulnerability identified as CVE-2024-35584. The application fails to sanitize the 'X-Forwarded-For' HTTP header before using it in SQL queries within multiple files, including Ajax.php, Modules.php, ForExport.php, ForWindow.php, and functions/HackingLogFnc.php. An authenticated attacker can exploit this to achieve unauthorized database access, modification, or deletion.

Impact

Successful exploitation allows an authenticated user to perform blind SQL injection, potentially leading to unauthorized data access, integrity compromise, or availability disruption. The CVSS 3.1 score for this vulnerability is 8.8 (High).

Recommendation

  • Audit web server logs for suspicious 'X-Forwarded-For' header values containing SQL keywords or characters such as single quotes, semicolons, or 'SLEEP' functions.
  • Implement parameterized queries in the identified PHP files (Ajax.php, Modules.php, ForExport.php, ForWindow.php, functions/HackingLogFnc.php) to prevent future injection.
  • Apply strict input validation on all HTTP headers used for logging or application logic.
  • Ensure all OpenSIS instances are updated to the latest available version if a patch is released to mitigate the identified vulnerability.

Immediate actions

Inventory all OpenSIS Community Edition instances to identify versions 8.0-9.1.

IT Operations 24h

Threat Hunt

Search web server logs for suspicious payloads in X-Forwarded-For headers.

T1190 high high confidence hunt now

Data: Web server access logs

Mitigations

Apply source code patches to identified files or restrict access to administrative functions.

immediate IT Operations

CVE-2024-35584

Detection coverage 1

Detects CVE-2024-35584 Exploitation - SQL Injection via X-Forwarded-For Header

high

Detects potential SQL injection attempts by searching for SQL keywords and meta-characters within the X-Forwarded-For HTTP header

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →