CVE-2021-41677
📋 TL;DR
A SQL injection vulnerability in openSIS version 8.0 allows attackers to execute arbitrary SQL commands through the Grade parameter. This affects all openSIS 8.0 installations using MySQL or MariaDB databases. Attackers can potentially access, modify, or delete sensitive student and school data.
💻 Affected Systems
- openSIS Classic
📦 What is this software?
Opensis by Os4ed
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via database server privilege escalation.
Likely Case
Unauthorized access to sensitive student records, grades, and personal information stored in the database.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions in place.
🎯 Exploit Status
The vulnerability is in a GET parameter, making exploitation trivial with standard SQL injection tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 8.1 or later
Vendor Advisory: https://github.com/OS4ED/openSIS-Classic/issues/202
Restart Required: No
Instructions:
1. Upgrade to openSIS version 8.1 or later. 2. Apply the patch that implements proper input validation and parameterized queries for the GetStuListFnc.php endpoint.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns in the Grade parameter
Input Validation Filter
allAdd server-side validation to only accept expected values for the Grade parameter
🧯 If You Can't Patch
- Restrict database user permissions to minimum required privileges
- Implement network segmentation to isolate the openSIS server from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Test the /opensis/functions/GetStuListFnc.php endpoint with SQL injection payloads in the Grade parameterCheck Version:
Check openSIS version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
- Access to GetStuListFnc.php with suspicious Grade parameters
Network Indicators:
- HTTP requests to GetStuListFnc.php containing SQL keywords in parameters
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/opensis/functions/GetStuListFnc.php" AND (param="Grade" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR 1=1")