CVE-2026-36670: OpenSIPS Control Panel SQLi Vulnerability

CVE-2026-36670 Overview

CVE-2026-36670 is a Time-Based Blind SQL Injection vulnerability affecting the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3. Authenticated attackers can execute arbitrary SQL commands by injecting payloads into the table GET parameter of alias_management.php. The flaw is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Successful exploitation enables attackers to read, modify, or destroy backend database contents that support SIP routing and subscriber management.

Critical Impact
Authenticated attackers can extract sensitive SIP subscriber and routing data, manipulate alias records, and potentially pivot to administrative compromise of the OpenSIPS Control Panel database.

Affected Products

OpenSIPS Control Panel (opensips-cp) versions prior to 9.3.3
The alias_management module within opensips-cp
Deployments exposing alias_management.php to authenticated users

Discovery Timeline

2026-06-15 - CVE-2026-36670 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-36670

Vulnerability Analysis

The vulnerability resides in alias_management.php, which accepts the table parameter via HTTP GET requests without proper sanitization or parameterization. The application passes the attacker-controlled value into a backend SQL query, allowing injection of arbitrary SQL syntax. Because the application does not return query output directly, exploitation relies on time-based blind techniques, where attackers infer data by measuring response delays induced by functions such as SLEEP() or BENCHMARK(). Authentication is required, which limits anonymous abuse, yet any low-privilege Control Panel user can leverage the flaw to escalate database access.

Root Cause

The root cause is improper neutralization of user input incorporated into SQL statements. The table parameter is concatenated into a query string rather than passed through prepared statements or an allow-list of valid table names. This omission allows SQL metacharacters and conditional time-delay payloads to alter query execution.

Attack Vector

The attack vector is network-based. An authenticated attacker sends a crafted HTTP GET request to alias_management.php with a malicious table value. The injected payload conditionally triggers database delays, enabling boolean-style extraction of arbitrary data, one bit or character at a time. No user interaction beyond the attacker's own session is required, and exploitation can be automated using common tooling such as sqlmap.

No verified public proof-of-concept code is included here. Technical details are available in the GitHub CVE-2026-36670 Advisory.

Detection Methods for CVE-2026-36670

Indicators of Compromise

HTTP GET requests to alias_management.php containing SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or comment sequences (--, #, /*) in the table parameter.
Web server access logs showing repeated, slightly varied requests to alias_management.php from a single authenticated session.
Database server logs showing unusually long-running queries originating from the OpenSIPS Control Panel application user.

Detection Strategies

Inspect web access logs for anomalous values of the table GET parameter that deviate from the application's expected enumerated table names.
Deploy a web application firewall (WAF) rule that flags or blocks SQL syntax tokens in table parameters across /opensips-cp/web/ endpoints.
Correlate authenticated session activity with backend query latency spikes to identify time-based blind injection probing.

Monitoring Recommendations

Forward opensips-cp web server and database logs to a centralized analytics platform for query pattern analysis.
Alert on bursts of requests to alias_management.php exceeding normal administrative usage baselines.
Monitor for new or unexpected database users, modified alias records, or schema changes following suspicious request patterns.

How to Mitigate CVE-2026-36670

Immediate Actions Required

Upgrade OpenSIPS Control Panel to version 9.3.3 or later, which addresses the injection flaw.
Restrict access to the Control Panel interface to trusted management networks using firewall or reverse proxy rules.
Audit existing Control Panel user accounts and revoke unnecessary privileges to limit the pool of potential authenticated attackers.
Rotate database credentials used by opensips-cp if exploitation is suspected.

Patch Information

Upgrade opensips-cp to version 9.3.3 or newer. Refer to the GitHub CVE-2026-36670 Advisory for fix details and verify the patched release through the official OpenSIPS distribution channels.

Workarounds

If immediate patching is not possible, place a WAF in front of opensips-cp and block requests containing SQL syntax in the table parameter.
Restrict alias_management.php access at the web server level to a defined list of administrator source IP addresses.
Apply least-privilege configuration to the database account used by opensips-cp, removing rights to schemas and tables outside its operational scope.

bash

# Configuration example: Nginx restriction for alias_management.php
location = /opensips-cp/web/alias_management.php {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://opensips_cp_backend;
}