CVE-2024-35584

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-35584
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35584.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-35584
Published
2024-10-15T19:15:16.957Z
Modified
2026-04-10T05:13:13.336802Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from "X-Forwarded-For" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.

References

Affected packages

Git / github.com/os4ed/opensis-responsive-design

Affected ranges

Type
GIT
Repo
https://github.com/os4ed/opensis-responsive-design
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0a2d61fff35900fc91566e6621d49959599bcb4e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
53407797404f05612b774e233bec52951986013b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.1"
        }
    ]
}

Affected versions

V7.*
V7.5
V7.6
V8.*
V8.0
V9.*
V9.0
V9.1
Ver7.*
Ver7.0Prod_update
Ver7.0beta1
v7.*
v7.1
v7.2
v7.3
ver7.*
ver7.1
ver7.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35584.json"