CVE-2026-36670

Name of the Vulnerable Software and Affected Versions OpenSIPS Control Panel versions prior to 9.3.3

Description A Time-Based Blind SQL Injection in the alias management module allows authenticated attackers to execute arbitrary SQL commands. This occurs via the 'table' GET parameter in the 'alias management.php' endpoint. Time-Based Blind SQL Injection is a technique where an attacker sends SQL queries and observes the time the server takes to respond to determine if the query was successful.

Recommendations Update to version 9.3.3 or later. As a temporary workaround, restrict access to the 'alias management.php' endpoint or avoid using the table parameter until the update is applied.