CVE-2026-49489: OpenCATS SQL Injection Vulnerability

CVE-2026-49489 Overview

CVE-2026-49489 is a SQL injection vulnerability in OpenCATS through version 0.9.7.4, an open-source applicant tracking system. The flaw resides in the sortDirection parameter of the DataGrid component, specifically within ajax/getDataGridPager.php. Authenticated attackers can inject malicious SQL statements through this parameter to perform time-based blind injection attacks. Successful exploitation allows extraction of sensitive database contents, including candidate records, user credentials, and configuration data. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can extract arbitrary database contents from OpenCATS deployments through time-based blind SQL injection in the DataGrid sorting parameter.

Affected Products

OpenCATS through version 0.9.7.4
OpenCATS DataGrid component (ajax/getDataGridPager.php)
All deployments exposing authenticated DataGrid endpoints

Discovery Timeline

2026-05-31 - CVE-2026-49489 published to the National Vulnerability Database
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-49489

Vulnerability Analysis

The vulnerability exists in OpenCATS's DataGrid pagination logic. When a user sorts a grid, the application accepts a sortDirection value via the AJAX endpoint ajax/getDataGridPager.php. The application concatenates this parameter directly into a SQL ORDER BY clause without parameterization or strict allow-list validation. As a result, attacker-supplied SQL fragments are interpreted by the database engine.

Exploitation requires valid authentication, but OpenCATS commonly grants DataGrid access to low-privileged staffing and recruiter roles. The injection point sits in a clause where typical defensive escaping is ineffective, because ORDER BY cannot accept bound parameters. Attackers leverage time-based blind techniques such as conditional SLEEP() or pg_sleep() payloads to extract data character by character. Refer to the VulnCheck advisory and the GitHub Security Advisory GHSA-8mc8-5gw6-c7w4 for vendor-confirmed technical details.

Root Cause

The root cause is unsanitized inclusion of the sortDirection HTTP parameter into a dynamically built SQL query. OpenCATS does not constrain the value to an allow-list of ASC or DESC, nor does it escape the input before string concatenation. This violates secure coding guidance for SQL ORDER BY clauses.

Attack Vector

The attack vector is network-based and requires low-privileged authenticated access. An attacker submits a crafted POST or GET request to ajax/getDataGridPager.php with a sortDirection value containing SQL syntax. The injected payload executes within the application's database context, enabling enumeration of tables, columns, and row contents. A working proof-of-concept is published at Exploit-DB entry 52579 and Packet Storm file 222200.

Detection Methods for CVE-2026-49489

Indicators of Compromise

Requests to ajax/getDataGridPager.php containing SQL keywords such as SLEEP, BENCHMARK, pg_sleep, UNION, SELECT, or IF( in the sortDirection parameter.
Web server access logs showing unusually long response times for DataGrid pager requests, consistent with time-based blind injection.
Repeated authenticated requests from a single session that iterate over sortDirection payloads of growing length.
Database error log entries referencing malformed ORDER BY clauses originating from the OpenCATS application user.

Detection Strategies

Deploy web application firewall rules that validate the sortDirection parameter against a strict allow-list of ASC and DESC.
Inspect HTTP request bodies for SQL meta-characters targeting OpenCATS DataGrid endpoints.
Correlate authenticated session activity with database query latency metrics to identify time-based injection patterns.
Enable database query auditing on the OpenCATS schema and alert on queries containing SLEEP or BENCHMARK functions.

Monitoring Recommendations

Forward OpenCATS web server and PHP error logs to a centralized analytics pipeline for query-pattern analysis.
Establish baseline response times for getDataGridPager.php and alert on statistical deviations.
Monitor for bulk data egress from the database host following anomalous DataGrid activity.
Track failed and unusual authentication events that precede DataGrid abuse.

How to Mitigate CVE-2026-49489

Immediate Actions Required

Upgrade OpenCATS to a release later than 0.9.7.4 once a vendor patch is published.
Restrict access to the OpenCATS web interface using IP allow-listing or a VPN until the patch is applied.
Audit and rotate any credentials or secrets stored within the OpenCATS database.
Review database audit logs for evidence of prior exploitation against ajax/getDataGridPager.php.

Patch Information

Monitor the OpenCATS GitHub Security Advisory GHSA-8mc8-5gw6-c7w4 for the official fix. A complete remediation requires validating the sortDirection parameter against a hard-coded allow-list before it is interpolated into any SQL statement. Reinstall or upgrade once the vendor publishes a fixed release.

Workarounds

Apply a reverse-proxy or WAF rule that rejects requests to ajax/getDataGridPager.php unless sortDirection equals ASC or DESC.
Restrict the OpenCATS database account to read-only access on non-critical tables to limit injection impact.
Disable or remove unused DataGrid views until the patched version is deployed.
Require multi-factor authentication for all OpenCATS accounts to raise the bar for the authenticated prerequisite.

bash

# Example NGINX rule rejecting non-allow-listed sortDirection values
location = /ajax/getDataGridPager.php {
    if ($arg_sortDirection !~* "^(ASC|DESC)$") {
        return 403;
    }
    proxy_pass http://opencats_backend;
}