SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the… (CVE-2025-67066)

The vulnerability identified as CVE-2025-67066 affects oasys sysoa version 1.0. It is an SQL Injection flaw that allows remote attackers to execute arbitrary code by manipulating the outtype parameter in the /outaddresspaging endpoint. No further technical details, such as exploitation methods or impact beyond arbitrary code execution, are provided. No patch or vendor advisory information is available to confirm remediation status.

Successful exploitation could allow a remote attacker to execute arbitrary code on the affected system, potentially leading to unauthorized data access or system compromise. However, no known exploits have been reported in the wild, and the extent of impact beyond code execution is not detailed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity related to the outtype parameter.