What is the CVSS score of CVE-2026-36670?

CVE-2026-36670 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of OpenSIPS Control Panel are affected by CVE-2026-36670?

OpenSIPS Control Panel versions prior to 9.3.3 contain an authenticated SQL injection vulnerability that allows privileged administrative users to compromise the entire database.

How to fix or mitigate CVE-2026-36670?

Within 24 hours: audit OpenSIPS Control Panel access logs for suspicious database queries; restrict administrative access via IP whitelisting and enable MFA for all panel accounts. Within 7 days: implement network segmentation isolating OpenSIPS Control Panel; deploy database activity monitoring with SQL injection detection rules; audit all panel users and review their access patterns. Within 30 days: prepare migration to OpenSIPS Control Panel 9.3.3 or later (when released) or evaluate alternative solutions; conduct administrator security awareness training; deploy Web Application Firewall rules to detect and block SQL injection attempts against the panel.

OpenSIPS Control Panel CVE-2026-36670

EUVD-2026-36748 HIGH

SQL Injection (CWE-89)

2026-06-15 mitre

GHSA-gj5p-m3gm-f29x

PHP SQLi N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable web parameter (AV:N), straightforward time-based blind injection (AC:L), requires authenticated panel user (PR:L), no victim interaction (UI:N), full DB CIA impact (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:28 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL commands via the 'table' GET parameter in alias_management.php.

AnalysisAI

Authenticated SQL injection in OpenSIPS Control Panel (opensips-cp) versions prior to 9.3.3 allows attackers with valid panel credentials to execute arbitrary SQL via the 'table' GET parameter in alias_management.php using time-based blind techniques. The flaw resides in the alias_management module and yields full database confidentiality, integrity, and availability impact per CVSS 8.8. No public exploit identified at time of analysis, and EPSS is low (0.28%, 19th percentile), but a third-party advisory documents the issue on GitHub.

Technical ContextAI

OpenSIPS Control Panel is a PHP-based web management interface for the OpenSIPS SIP proxy, used to administer routing, dispatcher rules, and alias mappings backed by a MySQL/MariaDB database. The alias_management.php script accepts a 'table' parameter via GET that is incorporated into a SQL query without adequate parameterization or whitelisting, matching CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Because the injection is time-based blind, exploitation relies on conditional SLEEP/BENCHMARK payloads to infer data byte-by-byte, which is slower but fully functional even when no query output is rendered. The 'PHP, SQLi' tagging and the n/a CPE reflect that NVD has not yet enumerated a formal product entry for opensips-cp.

RemediationAI

Upgrade OpenSIPS Control Panel to version 9.3.3 or later, which is identified in the advisory as the first fixed release. If immediate upgrade is not feasible, restrict network access to the opensips-cp web interface to trusted management subnets or via VPN, since the panel is an administrative tool and should not be exposed to the public internet; this has minimal operational side effects for properly segmented deployments. Additionally, rotate and tighten panel credentials, audit operator accounts for least privilege, and consider placing a WAF rule in front of alias_management.php to block non-whitelisted values of the 'table' parameter as a stopgap - note that WAF signatures for time-based blind SQLi are imperfect and should not be the sole control. Review database logs for anomalous SLEEP/BENCHMARK queries originating from the panel's DB user. See the advisory at https://github.com/Gabriel-Lacorte/CVE-2026-36670/blob/main/ADVISORY.md.