Executive Summary

CVE-2026-49489 is a high-severity SQL injection vulnerability in OpenCATS version 0.9.7.4 and earlier. It exists in the DataGrid component, specifically in the sortDirection parameter of the ajax/getDataGridPager.php endpoint. Authenticated users can inject malicious SQL code via this parameter because it is concatenated directly into SQL queries without proper validation.

This flaw allows attackers to perform time-based blind SQL injection attacks, enabling them to extract sensitive database contents such as user credentials, personal identifiable information (PII), and other confidential data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive and confidential data stored in the OpenCATS database. Attackers can extract information such as database version, database name, user counts, individual user credentials including usernames, access levels, and hashed passwords.

Because the attack requires only basic authentication and a single GET request, it can be exploited easily on default configurations, potentially compromising the integrity and confidentiality of your data.

The impact includes data breaches, exposure of personal and sensitive information, and potential further exploitation of compromised credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the sortDirection parameter in the ajax/getDataGridPager.php endpoint for SQL injection vulnerabilities. Authenticated users can attempt time-based blind SQL injection by injecting payloads that cause delays, such as using SQL functions like IF() and SLEEP().

A common detection method involves sending crafted HTTP GET requests with malicious SQL payloads in the sortDirection parameter and observing response delays to confirm the vulnerability.

• Use curl or similar tools to send requests with payloads that cause time delays, for example:
• curl -i -s -k -X GET 'http://target/ajax/getDataGridPager.php?sortDirection=ASC' --cookie 'auth=your_auth_cookie'
• Modify the sortDirection parameter to include a time delay payload, such as: ASC' AND IF(1=1,SLEEP(5),0)--

If the response time increases significantly (e.g., by 5 seconds), it indicates the presence of a time-based blind SQL injection vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying patches or updates provided by the OpenCATS project that fix the SQL injection vulnerability in the DataGrid component.

If patches are not immediately available, restrict or disable access to the ajax/getDataGridPager.php endpoint or the affected DataGrid functionality for authenticated users until a fix is applied.

Implement web application firewall (WAF) rules to detect and block malicious SQL injection payloads targeting the sortDirection parameter.

Review and enforce strict input validation and sanitization on all user-controllable parameters, especially sortDirection, to prevent injection of SQL special characters.

Monitor logs for suspicious activity related to the DataGrid component and unauthorized data access attempts.

Useful 0 Not Useful 0

Compliance Impact

The SQL injection vulnerability in OpenCATS allows authenticated attackers to extract sensitive database contents, including user credentials and personally identifiable information (PII).

Unauthorized access to such sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and confidential information against unauthorized disclosure.

Therefore, this vulnerability poses a significant risk to compliance with these standards by potentially exposing protected data through unauthorized database extraction.

Useful 0 Not Useful 0