openSIS SQL Injection Vulnerability in Ajax.php

A SQL injection vulnerability has been identified in openSIS version 9.1. This vulnerability allows remote attackers to execute arbitrary code by manipulating the id parameter in Ajax.php. The issue arises from improper handling of the parameter, which can be exploited by appending a single quote to trigger an SQL error, confirming the presence of the vulnerability.

Impact

Exploitation of this vulnerability allows for blind SQL injection, where an attacker can manipulate SQL queries and potentially execute arbitrary code on the server.

Reproduction

To reproduce this vulnerability, send a request to Ajax.php with the modname set to tools/GenerateApi.php, the modfunc set to remove, and the id parameter modified to include a single quote. The server will respond with an SQL error, indicating that the SQL injection vulnerability exists.