CVE-2025-67066 Overview
CVE-2025-67066 is a SQL Injection vulnerability in oasys sysoa version 1.0. The flaw resides in the outtype parameter of the /outaddresspaging endpoint. A remote, unauthenticated attacker can inject arbitrary SQL statements through this parameter. Successful exploitation allows attackers to execute arbitrary code against the backend database.
The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Public technical details are available in a GitHub SQL Injection Vulnerability Report.
Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, modify records, and potentially achieve code execution on the underlying system through the vulnerable outtype parameter.
Affected Products
- oasys sysoa version 1.0
Discovery Timeline
- 2026-09-04 - CVE-2025-67066 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2025-67066
Vulnerability Analysis
The vulnerability affects the /outaddresspaging path in oasys sysoa 1.0. The application accepts user-controlled input through the outtype parameter and passes it directly into a SQL query without sanitization or parameterization. This allows attackers to break out of the intended query context and inject arbitrary SQL syntax.
Because the endpoint is reachable over the network without authentication, exploitation requires no prior access. Attackers can enumerate database schemas, exfiltrate credentials, and manipulate stored data. Depending on database engine privileges, injection may extend to file system access or command execution via stacked queries or database-specific functions.
The EPSS probability currently sits at approximately 0.397%, indicating limited observed exploitation activity at time of publication. However, SQL injection flaws with public proof-of-concept documentation typically see rapid weaponization.
Root Cause
The root cause is missing input validation and lack of prepared statements when handling the outtype parameter. The application concatenates user input directly into SQL query strings, which is the canonical anti-pattern behind [CWE-89] flaws.
Attack Vector
Exploitation occurs remotely over HTTP by sending a crafted request to /outaddresspaging with a malicious outtype value. Attackers typically begin with boolean-based or union-based injection to confirm the vulnerability, then progress to data extraction or out-of-band exfiltration techniques. See the public vulnerability report for technical proof-of-concept details.
Detection Methods for CVE-2025-67066
Indicators of Compromise
- HTTP requests to /outaddresspaging containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, --, or /* in the outtype parameter.
- Unusual database query patterns originating from the oasys sysoa application account, including access to system tables like information_schema.
- Elevated database error rates or unexpected response time variance from the /outaddresspaging endpoint indicating time-based injection probing.
Detection Strategies
- Deploy web application firewall (WAF) rules that flag SQL syntax within the outtype query parameter of the /outaddresspaging route.
- Enable database query logging and alert on queries containing tautologies, comment sequences, or UNION operations from the application account.
- Correlate HTTP access logs with database audit trails to identify request-to-query patterns consistent with injection attempts.
Monitoring Recommendations
- Ingest web server and database logs into a centralized SIEM for continuous correlation and long-term retention.
- Baseline normal traffic to /outaddresspaging and alert on statistical anomalies in parameter length, character distribution, or request frequency.
- Monitor egress traffic from the database server for out-of-band data exfiltration channels such as DNS or HTTP callbacks.
How to Mitigate CVE-2025-67066
Immediate Actions Required
- Restrict network access to the oasys sysoa application, limiting exposure of /outaddresspaging to trusted networks only.
- Deploy WAF signatures blocking SQL injection payloads targeting the outtype parameter.
- Review database audit logs for prior exploitation attempts and rotate any credentials that may have been exposed.
- Reduce the privileges of the database account used by oasys sysoa to the minimum required for application function.
Patch Information
No vendor patch information is currently available in the NVD advisory. Refer to the public vulnerability report and monitor oasys sysoa distribution channels for security updates. Organizations running version 1.0 should treat all instances as vulnerable until an official fix is published.
Workarounds
- Place the application behind a reverse proxy that inspects and sanitizes query parameters before forwarding requests.
- Implement input validation at the perimeter enforcing strict allowlists for the outtype parameter value.
- Consider taking the /outaddresspaging endpoint offline if it is not required for business operations until a patch is available.
# Example WAF rule (ModSecurity) blocking SQL syntax in outtype parameter
SecRule ARGS:outtype "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|;|/\*|xp_)" \
"id:1006706,phase:2,deny,status:403,msg:'CVE-2025-67066 SQLi attempt on outtype parameter'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
