CVE-2026-36670: Time-Based SQL Injection in OpenSIPS Control Panel < 9.3.3

Technical summary

CVE-2026-36670 is a time-based blind SQL injection flaw in the alias_management.php module of opensips-cp. The vulnerability stems from insufficient input validation on the 'table' GET parameter, allowing authenticated users to inject SQL payloads. Time-based blind injection techniques enable attackers to exfiltrate data by observing query execution timing differences, even when direct error messages are suppressed. The vulnerability affects all versions prior to 9.3.3.

Business impact

Compromise of the OpenSIPS Control Panel database could expose VoIP infrastructure configurations, user credentials, call routing rules, and telephony service records. An authenticated attacker could modify routing tables to intercept calls, delete audit logs, or poison configuration data. For organizations relying on OpenSIPS for hosted PBX or carrier-grade VoIP services, this enables service disruption, fraud, and regulatory non-compliance (particularly under telecom and data protection regimes).

Affected systems

OpenSIPS Control Panel (opensips-cp) versions prior to 9.3.3 are vulnerable. The attack requires prior authentication, so the threat is primarily from insider threats, compromised admin accounts, or attackers who have gained initial access to the control plane. Any deployment exposing the alias_management.php module on a network with untrusted authenticated users is at risk.

Exploitability

Exploitability is moderate in scope but high in impact. The attack requires valid authentication credentials—a significant barrier for external attackers but a material risk for insider threats and post-compromise scenarios. Time-based blind SQL injection is slower and noisier than error-based injection but is reliably weaponizable with standard tools. No user interaction or special privileges beyond authentication are needed. The attack is fully automatable and does not depend on specific database versions.

Remediation

Upgrade OpenSIPS Control Panel to version 9.3.3 or later. This release patches the input validation flaw in alias_management.php. Organizations unable to upgrade immediately should implement network access controls limiting authentication to the control panel, enforce strong credential hygiene, and monitor for suspicious SQL timing patterns in access logs. Consider disabling the alias management module if unused.

Patch guidance

Apply the official update to opensips-cp 9.3.3 or later as released by the OpenSIPS project. Verify the update is available through your deployment channel (source repository, package manager, or vendor distribution) and test in a non-production environment before rolling out. Confirm post-update that the alias_management.php module functions correctly and that authentication still functions as expected.

Detection guidance

Monitor access logs for repeated requests to alias_management.php with unusual or suspiciously long query strings in the 'table' parameter. Watch for SQL keywords (UNION, SELECT, SLEEP, BENCHMARK) embedded in URL-encoded GET parameters. Implement database query logging to capture and alert on unexpected timing delays or failed queries from the control panel application user. Review authentication logs for unusual login patterns or privilege escalation by control panel users.

Why prioritize this

Although the vulnerability requires prior authentication, the combination of high impact (full database read/write), ease of exploitation (standard SQL injection tooling), and critical business context (VoIP infrastructure) warrants rapid patching. The time-based blind technique makes detection difficult, increasing dwell time risk. Organizations with public-facing OpenSIPS control panels or high-value VoIP services should treat this as urgent.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects high confidentiality and integrity impact (C:H, I:H, A:H), low attack complexity (AC:L), network accessibility (AV:N), and the requirement for authentication (PR:L). The score appropriately captures a post-authentication vulnerability with severe database compromise potential but underweights insider and supply-chain contexts; security teams should apply organizational risk multipliers based on attack surface, user count, and VoIP criticality.

Frequently asked questions