Executive brief
OSNexus QuantaStor is a storage management platform used to control large-scale data storage across corporate networks. A security flaw in its login system allows an attacker to bypass the login screen entirely or steal administrative credentials without needing a valid password. This could lead to unauthorized access to sensitive stored data, service disruptions, or full control over the storage infrastructure.
Technical details
An unauthenticated SQL injection vulnerability exists in the username field of the OSNexus QuantaStor SDS Manager login endpoint. The application fails to properly sanitize the username input before incorporating it into a SQL query. An attacker can exploit this by providing a crafted SQL payload (e.g., ' OR 1=1--) to bypass authentication and log in as an administrator. Additionally, the vulnerability can be used for blind SQL injection; by observing differential error messages (e.g., 'invalid characters' vs 'not authorized' errors triggered by the load_extension function), an attacker can exfiltrate sensitive database values, such as password hashes, character by character. The vulnerability affects versions up to 6.6.1.
Affected products
- OSNexus QuantaStor SDS Manager up to 6.6.1
Timeline
- 2025-10-21: other: Vulnerability discovered by Black Lantern Security
- 2025-10-31: other: Initial report to OSNexus
- 2026-06-04: disclosed: Public disclosure and NVD publication