Executive brief
OASYS sysoa is a web application component used in organizational management systems. A SQL injection vulnerability in the outtype parameter allows an unauthenticated remote attacker to execute arbitrary code, potentially compromising the entire application, exposing sensitive organizational data, and disrupting business operations.
Technical details
This is a classic SQL injection vulnerability in the outtype parameter of the /outaddresspaging endpoint in OASYS sysoa version 1.0. The application fails to properly sanitize user input before incorporating it into SQL queries, allowing an attacker to inject arbitrary SQL commands. The vulnerability is remotely exploitable without authentication. Successful exploitation enables arbitrary code execution on the backend database and potentially the application server, leading to complete system compromise. Patches or mitigations have not been verified at this time.
Affected products
- OASYS sysoa 1.0
Timeline
- 2025-09-04: disclosed