CVE-2026-36670 Details

A time-based blind SQL injection vulnerability has been identified in the alias management module of OpenSIPS Control Panel (opensips-cp) versions prior to 9.3.3. This vulnerability allows authenticated attackers to execute arbitrary SQL commands by injecting SQL syntax into the 'table' GET parameter in alias_management.php. The issue arises from the unsafe concatenation of user-controlled data into an SQL query, which is executed against the backend database. While traditional SQL injection methods may be ineffective due to the use of PDO with error handling that suppresses feedback, the vulnerability can be exploited using time-based techniques to extract information from the database.

Users are advised to update OpenSIPS Control Panel to version 9.3.3 or later to address this vulnerability.