EUVD-2026-33501
GHSA-5cpr-5mvp-9f62
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged OpenCATS account
-
DeliveryAuthenticate to DataGrid interface
-
ExploitSend crafted sortDirection payload to ajax/getDataGridPager.php
-
ExecutionTrigger time-based blind SQL injection
-
PersistIteratively exfiltrate database contents
-
ImpactHarvest candidate PII and credential hashes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the OpenCATS instance (CVSS PR:L) with permission to reach the DataGrid pager endpoint ajax/getDataGridPager.php, and network connectivity to the OpenCATS web interface. Affects all versions of OpenCATS up to and including 0.9.7.4 in default configuration - no non-default feature toggle or special deployment mode is needed beyond having the DataGrid component (a core ATS feature) enabled. Limiting factors are the low-privilege account requirement (mitigated where self-registration or shared accounts are permitted) and the time-based blind nature of the injection, which is noisier and slower than in-band SQLi but still fully automatable with sqlmap or the published PoC. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L indicates network-reachable, low-complexity exploitation requiring low privileges and no user interaction, with high confidentiality loss to the vulnerable system and a scope change affecting subsequent systems' confidentiality. Publicly available exploit code (Exploit-DB 52579, Packet Storm) materially raises real-world risk, as attackers no longer need to develop a working payload. The CVE is not listed in CISA KEV, and no EPSS score was supplied in the input, so widespread mass-exploitation status is unconfirmed. The PR:L requirement is the primary limiting factor - any account with ATS access (recruiter, internal user, or a self-registered account on a misconfigured instance) is sufficient, which significantly lowers the barrier in environments where many users hold low-tier credentials. Because the data at risk includes candidate PII, resumes, and recruiter notes, the practical confidentiality impact is severe and warrants prioritized patching despite the absence of KEV listing. |
| Exploit ScenarioDerived | An attacker with any valid low-privileged OpenCATS account (e.g., a junior recruiter, a compromised user, or a self-registered account on a permissive deployment) sends a crafted HTTP request to ajax/getDataGridPager.php with a time-based blind payload in the sortDirection parameter, such as a conditional SLEEP() boolean oracle. By measuring response delays across iterated requests - facilitated by the publicly available Exploit-DB 52579 PoC - the attacker progressively extracts candidate PII, resumes, password hashes, and recruiter notes from the OpenCATS database. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 31, 2026
SQL injection in OpenCATS through 0.9.7.4 allows authenticated users to extract arbitrary database contents by injecting malicious SQL into the sortDirection parameter of ajax/getDataGridPager.php. Publicly available exploit code exists (Exploit-DB 52579, Packet Storm), and the issue was disclosed via a GitHub Security Advisory coordinated with VulnCheck. The CVSS 4.0 base score of 8.4 reflects high confidentiality impact with a subsequent-system scope change, though exploitation requires a valid low-privileged account.
Earlier versions of this analysis (2)
SQL injection in OpenCATS through 0.9.7.4 allows authenticated users to exfiltrate database contents via the sortDirection parameter handled by ajax/getDataGridPager.php in the DataGrid component. Publicly available exploit code exists (Exploit-DB 52579, Packet Storm), and the flaw enables time-based blind SQLi to read sensitive applicant, recruiter, and credential data stored by the applicant tracking system. No public exploit identified at time of analysis confirms active exploitation, but the combination of low-privilege requirement and published PoC makes this a near-term operational risk for exposed instances.
SQL injection in OpenCATS through 0.9.7.4 allows authenticated users to extract database contents by manipulating the sortDirection parameter sent to ajax/getDataGridPager.php. The DataGrid component fails to sanitize this parameter, enabling time-based blind SQL injection that exposes sensitive recruitment data such as candidate PII, credentials, and internal records. Publicly available exploit code exists (Exploit-DB 52579, Packet Storm), elevating practical risk despite the authenticated-attacker requirement.
RemediationAI
No vendor-released patched version is independently confirmed in the supplied data - the GitHub Security Advisory GHSA-8mc8-5gw6-c7w4 should be consulted at https://github.com/opencats/OpenCATS/security/advisories/GHSA-8mc8-5gw6-c7w4 for the upstream fix status and any tagged release beyond 0.9.7.4. Until a confirmed patched build is deployed, restrict the ajax/getDataGridPager.php endpoint at the reverse proxy or WAF layer with an allowlist for sortDirection values of exactly 'ASC' or 'DESC' (any other value should be dropped), which neutralizes the injection vector with minimal functional impact since these are the only legitimate values. Additionally, tighten account provisioning to remove dormant or shared low-privilege accounts, and place the OpenCATS instance behind authenticated VPN or IP allowlisting to shrink the attacker population; the trade-off is reduced accessibility for remote recruiters. Monitor database query logs for anomalous SLEEP(), BENCHMARK(), or unusually long-running ORDER BY queries originating from the DataGrid endpoint as a detection-side control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenCATS is an open-source PHP-based Applicant Tracking System (CPE cpe:2.3:a:opencats:opencats). The vulnerability sits in the DataGrid component's pager AJAX endpoint (ajax/getDataGridPager.php), where the sortDirection request parameter is concatenated into a SQL ORDER BY clause without proper sanitization or parameterization. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw, and because ORDER BY clauses cannot be bound as standard prepared-statement parameters, developers often fall back to string concatenation - making this class of bug a recurring pattern in PHP web applications. The injection is exploitable as time-based blind, meaning attackers infer data via response-delay oracles (e.g., SLEEP() payloads) rather than direct output.
Know when Opencats gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to extract database contents. Attackers can inject malicious SQL via the sortDirection parameter in ajax/getDataGridPager.php to perform time-based blind injection attacks and read sensitive data.
Executive ViewAI
OpenCATS versions through 0.9.7.4 contain a SQL injection vulnerability in the ajax/getDataGridPager.php sortDirection parameter that allows authenticated low-privilege users to extract arbitrary database contents. Publicly available exploit code exists (Exploit-DB 52579), and no vendor patch is currently available, requiring immediate containment and detection measures. This represents a significant insider threat creating potential exposure of sensitive data stored within the application.
Restrict network access to OpenCATS application to trusted internal IP ranges only; implement real-time monitoring of database query logs for SQL injection patterns; mandate multi-factor authentication for all OpenCATS user accounts; deploy WAF protection specifically targeting sortDirection parameter manipulation in ajax/getDataGridPager.php requests; isolate OpenCATS database on separate network segment; conduct monthly audits of user account permissions and database access privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution in OpenCATS installer allows unauthenticated attackers to inject and execute arbitrary PHP code by
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax fu
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUti
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. Rated cr
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying opera
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerr
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion func
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. Rated medium se
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update functi
Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javas
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter i