CVE-2021-39379
📋 TL;DR
This SQL injection vulnerability in openSIS 8.0 allows attackers to execute arbitrary SQL commands on the MySQL/MariaDB database through the password_stn_id parameter in ResetUserInfo.php. Any openSIS 8.0 installation using MySQL/MariaDB as the database backend is affected, potentially compromising student information systems.
💻 Affected Systems
- openSIS Classic
📦 What is this software?
Opensis by Os4ed
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, and potential remote code execution on the database server.
Likely Case
Unauthorized access to sensitive student and staff data, grade manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
The vulnerability is in a publicly accessible PHP file with no authentication required. Exploitation requires knowledge of the parameter name and basic SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.1 or later
Vendor Advisory: https://github.com/OS4ED/openSIS-Classic
Restart Required: No
Instructions:
1. Upgrade to openSIS 8.1 or later. 2. Apply the patch that adds proper input validation/sanitization to the password_stn_id parameter in ResetUserInfo.php. 3. Test the application functionality after patching.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to only accept numeric values for the password_stn_id parameter
Modify ResetUserInfo.php to include: if(!is_numeric($_POST['password_stn_id'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting the ResetUserInfo.php endpoint
Add WAF rule: deny requests to ResetUserInfo.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Implement strict database user permissions with least privilege principle
- Block external access to ResetUserInfo.php via network firewall or web server configuration
🔍 How to Verify
Check if Vulnerable:
Test if ResetUserInfo.php accepts SQL injection payloads in the password_stn_id parameter (e.g., password_stn_id=1' OR '1'='1)Check Version:
Check openSIS version in admin panel or review source code version markersVerify Fix Applied:
Verify that SQL injection attempts no longer work and that the parameter is properly validated/sanitized📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web server logs
- Unusual database queries from web application user
- Multiple failed login attempts or password reset requests
Network Indicators:
- HTTP requests to ResetUserInfo.php with SQL keywords in parameters
- Unusual database traffic patterns
SIEM Query:
source="web_server.log" AND uri="/ResetUserInfo.php" AND (param="password_stn_id" AND value MATCHES "[';]|UNION|SELECT|INSERT|UPDATE|DELETE|DROP")