CVE-2024-51211: SQL Injection

Published Nov 8, 2024

Updated

SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $usernamestnid parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.

Affected Software

3 affected components

OS4ED openSIS-Classic

OS4ED openSIS=9.0

OS4ED openSIS=9.1

Event History

Nov 8, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-51211?

CVE-2024-51211 has a high severity due to its potential for SQL injection attacks.

How do I fix CVE-2024-51211?

To fix CVE-2024-51211, ensure proper input validation and sanitization for the $username_stn_id parameter in the resetuserinfo.php file.

What is the impact of CVE-2024-51211?

The impact of CVE-2024-51211 allows attackers to execute arbitrary SQL commands, potentially compromising the database.

Which version of openSIS-Classic is affected by CVE-2024-51211?

CVE-2024-51211 specifically affects OS4ED openSIS-Classic Version 9.1.

What is the nature of the vulnerability described in CVE-2024-51211?

CVE-2024-51211 is an SQL injection vulnerability caused by improper input validation.