Executive brief
OpenSIPS Control Panel is a web-based interface used to manage OpenSIPS, a popular open-source tool for handling internet-based phone calls and messaging. A security flaw in the alias management section allows a logged-in user to run unauthorized database commands. This could lead to the theft of sensitive configuration data, user information, or the disruption of communication services.
Technical details
A time-based blind SQL injection vulnerability exists in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3. The flaw is located in alias_management.php and stems from the unsafe concatenation of the 'table' GET parameter into an SQL query. While the application uses PDO with silent error reporting, which may cause the web template to crash after execution, the SQL command is still processed by the backend database. An authenticated attacker can leverage time-based techniques to exfiltrate data from the database. Users should upgrade to version 9.3.3 or later to remediate this issue.
Affected products
- OpenSIPS OpenSIPS Control Panel < 9.3.3
Timeline
- 2026-06-09: disclosed: Initial disclosure date reported in advisory
- 2026-06-15: advisory: CVE published to NVD dataset