CVE-2024-35584 describes SQL injection vulnerabilities in OpenSis Community Edition, specifically in Ajax.php, ForWindow.php, ForExport.php, Modules.php, and functions/HackingLogFnc.php files. The root cause is the lack of input sanitization on values taken from the X-Forwarded-For HTTP header, which are directly appended to SQL INSERT statements. This allows an authenticated user to perform SQL injection attacks, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects versions up to 9.1 and possibly earlier.

Successful exploitation can lead to full compromise of the database, including unauthorized data disclosure, data modification, and denial of service. The CVSS 3.1 base score of 8.8 reflects high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity requiring authentication.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges to minimize risk and monitor for suspicious activity related to SQL injection attempts.