SQL Injection in GouGuOA via Keywords Parameter

Executive Summary

GouGuOA v6.0.5 and earlier has a SQL injection flaw in the /home/message/rubbish endpoint. The keywords parameter is directly inserted into SQL queries without sanitization, allowing attackers to inject malicious SQL commands.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability in GouGuOA, check if the /home/message/rubbish endpoint is accessible and test the keywords parameter with SQL injection payloads like ' OR 1=1 -- or EXTRACTVALUE(1,CONCAT(0x7e,(SELECT password FROM users LIMIT 1),0x7e))

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid login session could exploit this to extract sensitive data like admin credentials or perform unauthorized actions on the database. The attack bypasses permission checks and works even when debugging is disabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GouGuOA to version 6.0.6 or later. If an update is not available, apply input validation to the keywords parameter and replace raw SQL queries with parameterized queries to prevent injection.

Useful 0 Not Useful 0