CVE-2024-35584

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-35584

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35584.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-35584

Published

2024-10-15T00:00:00Z

Modified

2026-08-12T03:51:13.219086377Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from "X-Forwarded-For" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35584.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/os4ed/opensis-classic

Affected ranges

Type

GIT

Repo

https://github.com/os4ed/opensis-classic

Events

Introduced

0a2d61fff35900fc91566e6621d49959599bcb4e

Last affected

53407797404f05612b774e233bec52951986013b

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:os4ed:opensis:8.0:*:*:*:community:*:*:*",
        "cpe:2.3:a:os4ed:opensis:9.1:*:*:*:community:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.0"
        },
        {
            "last_affected": "8.0"
        },
        {
            "introduced": "9.1"
        },
        {
            "last_affected": "9.1"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

8.*

8.0

9.*

9.1

V8.*

V8.0

V9.*

V9.0

V9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35584.json"