The GUnet OpenEclass 1.7.3 e-learning platform is vulnerable to multiple SQL injection flaws that could allow an attacker to extract sensitive database information.

This vulnerability consists of multiple SQL injection flaws located in various modules, including the agenda module. An attacker with a low-privileged student account can exploit these unvalidated parameters to execute error-based or time-based SQL injection attacks to compromise database integrity.

Successful exploitation of these SQL injection vulnerabilities can lead to the unauthorized extraction of sensitive institutional data, including student records and administrative credentials. Given the CVSS score of 7.1, this is a high-severity issue that threatens the confidentiality of the e-learning platform and could facilitate further unauthorized access or total system compromise.

Immediate Action: Organizations must update to the latest available version of OpenEclass that includes patches for these SQL injection vulnerabilities. If an update is not immediately feasible, restrict access to the application and disable the vulnerable agenda and course work modules.

Proactive Monitoring: Security teams should review web server access logs for anomalous patterns, such as unexpected SQL syntax characters or high volumes of error-based responses originating from the agenda module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets to detect and block SQL injection patterns targeting the application parameters.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the Exploit-DB entry 48163.

The presence of multiple SQL injection vectors in a widely used e-learning platform presents a significant risk to institutional data security. Administrators are strongly urged to apply the necessary vendor patches immediately. If the software is end-of-life or cannot be patched, it should be isolated from production networks to prevent unauthorized data access.