EUVD-2026-92469
GHSA-vhh3-gm7q-rqjf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach GouGuOA web interface
-
DeliveryCraft SQLi in keywords parameter
-
ExploitPOST to /home/message/rubbish
-
ExecutionBackend executes injected SQL
-
ImpactExfiltrate or tamper with database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the GouGuOA /home/message/rubbish endpoint and supplying a malicious keywords parameter; the affected version is 6.0.5 and earlier. The supplied CVSS vector rates this unauthenticated (PR:N, UI:N), but the endpoint is a message trash/recycle-bin function that in typical OA deployments is reachable only after login, so a valid user session may in practice be a prerequisite - this should be verified against the source write-up, as it materially limits realistic exploitation. Limiting factors: small installed base of GouGuOA, exposure depends on the web interface being network-reachable, and possible authentication gating of the endpoint. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a trivially exploitable, remote, unauthenticated SQL injection (CWE-89) with full confidentiality, integrity and availability impact - the classic profile of a high-priority flaw. A public reference (github.com/fangtang7) documents the injection in /home/message/rubbish via the keywords parameter, so publicly available exploit code exists. However, several real-risk-tempering signals are present: no EPSS score was provided, the vulnerability is NOT in CISA KEV (no confirmed active exploitation), and GouGuOA is a niche, primarily Chinese-market open-source OA product with a small deployment footprint, which limits mass-exploitation incentive. There is also a plausible conflict between the CVSS PR:N (unauthenticated) rating and the affected endpoint: /home/message/rubbish is a message 'trash/recycle' feature, which in most OA systems sits behind a user session - verify the actual authentication requirement with the vendor/source, as PR:N may be overstated. Net: a genuinely dangerous, easily weaponized SQLi for the limited population running GouGuOA ≤6.0.5, but given low prevalence and no evidence of widespread or active exploitation, it is a patch-promptly item for affected operators rather than an internet-wide emergency. |
| Exploit ScenarioDerived | A remote attacker sends a crafted HTTP request to the /home/message/rubbish endpoint with a malicious payload in the keywords parameter, injecting SQL into the backend query. Because a public write-up/PoC exists for GouGuOA ≤6.0.5 and the CVSS attack complexity is low, the attacker can reliably extract database contents (credentials, user data) or tamper with records; note the endpoint may require a valid user session despite the PR:N rating. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
SQL injection in GouGuOA 6.0.5 and earlier allows an attacker who can reach the /home/message/rubbish endpoint to inject arbitrary SQL through the keywords parameter, yielding full compromise of confidentiality, integrity and availability of the backend database (CWE-89, CVSS 3.1 base 9.8 as reported). The MITRE-supplied vector rates it unauthenticated (PR:N/UI:N), but our independent assessment lowers the privilege metric to PR:L because /home/message/rubbish is a message trash/recycle-bin function that in typical OA deployments is only reachable after login, so a valid session may in practice be a prerequisite - this materially changes the realistic attack surface and should be verified against the referenced write-up. No public exploit code has been confirmed and the CVE is not listed in CISA KEV, though a public technical write-up exists at the referenced GitHub repository; no EPSS score was available in the input, so no probability estimate is asserted.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed version number is provided in the input data, so remediation must begin with compensating controls rather than an upgrade. First, confirm the affected version with the vendor and request a patch or a supported migration path; until one exists, restrict network exposure of the GouGuOA web interface - place it behind a VPN or an authenticating reverse proxy and remove it from direct internet reachability, which eliminates the remote attack path (trade-off: reduced accessibility for remote staff). Second, enforce a valid, authenticated session for all /home/message/rubbish access at the reverse-proxy or application-server layer, since our assessment indicates a logged-in user is likely required in practice (trade-off: none for legitimate users, but it must actually be enforced because the supplied vector assumes the endpoint is reachable unauthenticated). Third, reduce the blast radius by running the application's database account with least privilege - no DDL, and no DELETE/DROP outside the tables the message module legitimately needs - and by rotating any database credentials stored in application configuration (trade-off: schema changes or admin features may break and need re-testing). Fourth, deploy a WAF rule that blocks SQL metacharacters and stacked-query patterns on the keywords parameter and monitor for anomalous or error-generating requests to that endpoint; treat WAF as a stopgap only, since encoding and comment-based bypasses are well known, and log verbosely to detect exploitation attempts. Finally, monitor database logs and message-table integrity for unexplained deletions or bulk reads. Consult the public write-up at https://github.com/fangtang7/CVE/blob/main/GouGuOA/sql.md for the exact injection payload structure to validate any virtual patching.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-89, improper neutralization of special elements used in an SQL command, in the GouGuOA office-automation platform. The vulnerable code path is the message module's recycle-bin handler at /home/message/rubbish, where the user-supplied keywords parameter is incorporated into a database query without adequate parameterization or escaping; the 'rubbish' (trash) semantic suggests the query operates over the message table(s), likely a LIKE-based search or filter clause built by string concatenation, which is the classic injection pattern. GouGuOA is a web-delivered OA suite (Java/MVC-style routing, typically backed by MySQL or SQL Server), so a successful injection gives the attacker the privileges of the application's database account: unrestricted read of business data (users, credentials, internal messages), arbitrary modification or deletion of records - amplified here because the underlying operation is a trash/delete-capable handler - and possible denial of service. The CPE data supplied is an unnormalized placeholder (cpe:2.3:a:n/a:n/a), and the EUVD affected-version field likewise contains only 'n/a n/a', meaning the vendor and product are not properly registered in NVD/CPE dictionaries; vulnerability scanners relying on CPE matching will therefore not reliably identify exposed instances, and affected-version scoping rests solely on the description ('v6.0.5 and before'). The scope is unchanged (S:U) and all three impact metrics are High, consistent with direct database access rather than lateral movement.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network SQLi with low complexity and full DB impact; PR:L chosen because the message trash endpoint typically requires an authenticated session despite the input's PR:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
Executive ViewAI
GouGuOA, the office-automation platform used for internal messaging and document workflows, contains a critical SQL injection flaw (CVE-2026-88395) affecting version 6.0.5 and earlier that can hand an attacker full control of the underlying database. Because the product ships with no vendor fix, every deployment running GouGuOA at or below 6.0.5 remains exposed until compensating controls or an upgrade path are put in place. Leadership should care because compromise of the backend database places employee records, internal communications and any data the OA platform touches at risk of theft, alteration or destruction, with potential regulatory and operational consequences.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB