OpenCATS EUVD-2026-112509

Exploitation requires a valid, authenticated OpenCATS session (PR:L) with access to the home Calls DataGrid (home:CallsDataGrid) or activity DataGrid (activity:ActivityDataGrid) endpoints; the attacker must supply manipulated period, startDate, or endDate parameters in the DataGrid request payload, which are inserted into SQL date comparisons in modules/home/dataGrids.php and modules/activity/dataGrids.php without safe escaping. Limiting factors: authentication is mandatory and unauthenticated exploitation is not established, and exposure can be reduced (but not eliminated) by restricting the affected DataGrid views to trusted users; per the vendor, upgrading to v0.10.0 is the only complete fix. All versions prior to 0.10.0 (packagist opencats/opencats <= 0.9.7.4) are affected.

This is a genuine but moderate-priority issue, not an emergency. The vendor-confirmed signals are consistent: CVSS 3.1 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) describes a network-reachable, low-complexity SQL injection that requires authentication (PR:L), and the GHSA advisory corroborates that a valid OpenCATS login is mandatory and unauthenticated exploitation is not established. The vuln.today decision label is 'this_week' rather than act_now/emergency, which aligns with the authenticated prerequisite. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input - the only references are the GHSA advisory, the fix commit, and the v0.10.0 release tag, so there is no evidence of in-the-wild activity. One data discrepancy worth noting: NVD/input assigns CWE-20 (improper input validation), while the GHSA advisory assigns CWE-89 (SQL injection) and titles the issue explicitly as authenticated SQL injection - the GHSA classification is the more precise root cause and is confirmed by the code diff. Net: a real, confirmed vulnerability whose practical risk is bounded by the authentication requirement and the niche deployment footprint of OpenCATS, warranting prompt patching but not crisis handling.

An attacker who already holds a valid OpenCATS account (for example a low-privilege recruiter login, or a compromised staff credential) opens the home Calls DataGrid or the activity DataGrid and submits crafted period, startDate, or endDate filter values that break out of the intended date comparison. Because these values are concatenated into the SQL date filter without escaping, the attacker rewrites the query to read data beyond their normal view - user accounts, candidate records, contacts, company data, job orders, and activity history. No public exploit code is identified at time of analysis, but the fix commit publicly reveals the exact vulnerable parameters and sink.