CVE-2024-35584

A SQL injection vulnerability exists in OpenSIS Community Edition versions 9.1 through 8.0 (and possibly earlier) due to a lack of input sanitization. The application takes arbitrary values from the X-Forwarded-For header and directly appends them into SQL INSERT statements. Specifically, the vul...

CVE-2024-35584: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to...