Description
OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable restrictions by manipulating filter requests to execute arbitrary SQL queries against the database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenCATS | OpenCATS | ≤ 0.9.1a | — |
References
- GitHub Security Advisory (GHSA-gmpc-j6h7-vw74) vendor-advisory
- VulnCheck Advisory: OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column third-party-advisory