CVE-2026-49489: OpenCATS - SQL Injection in DataGrid sortDirection Parameter

Synopsis

SQL injection in OpenCATS, an open-source applicant tracking system, affects the sortDirection parameter of the DataGrid component in versions through 0.9.7.4. The vulnerability is reachable over the network by any authenticated user and exploits unsanitized input passed to ajax/getDataGridPager.php to perform time-based blind SQL injection. Successful exploitation allows an attacker to read the full contents of the underlying database, including candidate records, user credentials, and other stored data. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint (ajax/getDataGridPager.php) is served over HTTP/HTTPS, so the attacker must be able to reach the OpenCATS service across the network.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; no administrative role is needed to reach the vulnerable parameter.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the endpoint; no user action or social engineering is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the injection requires no race conditions, memory layout knowledge, or special environmental setup beyond network access and a valid session.

Blast Radius

• Reads full database contents via time-based blind SQL injection, including stored candidate profiles, resumes, contact details, and internal HR notes.
• Extracts application user records including usernames and hashed or plaintext passwords, enabling credential reuse attacks against other systems.
• Causes measurable latency degradation on the database host due to repeated time-delay payloads, partially disrupting availability of the OpenCATS instance during an active attack.
• Reaches data held in subsidiary or linked database schemas if the OpenCATS database user has cross-schema SELECT privileges.