CVE-2026-49489: OpenCATS SQL Injection in DataGrid sortDirection Parameter

Technical summary

CVE-2026-49489 is a SQL injection vulnerability located in the DataGrid component's sortDirection parameter within ajax/getDataGridPager.php. The parameter fails to properly validate or sanitize user input before constructing SQL queries. An authenticated attacker can leverage time-based blind SQL injection techniques to exfiltrate database contents without triggering immediate errors. The vulnerability affects OpenCATS versions through 0.9.7.4 and requires valid application credentials to exploit.

Business impact

Organizations using OpenCATS to manage recruitment workflows face exposure of sensitive applicant data, including personal information, employment history, and internal hiring assessments. A compromised database could leak competitive intelligence about hiring practices, candidate pipelines, and organizational structure. If candidate data is exposed, organizations may face regulatory compliance violations (GDPR, CCPA) and reputational damage. The threat is elevated because ATS systems are prime targets for corporate espionage and insider threats.

Affected systems

OpenCATS through version 0.9.7.4 is affected. Organizations should verify their installed version in the application settings or by checking the release history. Only authenticated users can execute the attack, meaning the risk is primarily from internal users or attackers who have obtained valid credentials through phishing, credential stuffing, or social engineering.

Exploitability

The vulnerability requires authentication, which reduces the pool of potential attackers but does not eliminate the risk. Malicious insiders, contractors, or users whose credentials are compromised pose a credible threat. The attack is not visible to end-users and can be executed programmatically via API calls to ajax/getDataGridPager.php, making it attractive for large-scale data theft. No user interaction is required once an attacker has valid credentials.

Remediation

Immediate steps include upgrading OpenCATS to a patched version released after 0.9.7.4 (verify against the vendor advisory). As an interim measure, restrict access to the DataGrid sorting feature via web application firewall rules or network segmentation, monitor authentication logs for suspicious activity, and implement principle of least privilege for database accounts. Apply input validation and parameterized queries across the codebase to prevent SQL injection.

Patch guidance

Contact the OpenCATS project or check official release repositories for patched versions beyond 0.9.7.4. If you maintain OpenCATS internally, apply code review and security testing to confirm SQL injection is resolved in the sortDirection parameter. Test the patch in a staging environment before production deployment, focusing on data grid sorting functionality and API endpoint behavior.

Detection guidance

Monitor ajax/getDataGridPager.php access logs for unusual sortDirection parameter values containing SQL syntax (keywords like UNION, SELECT, SLEEP, BENCHMARK). Implement database query logging to detect anomalous SELECT statements originating from the application layer. Alert on authentication followed by multiple failed or time-delayed API requests. Use Web Application Firewall (WAF) rules to block common SQL injection payloads in the sortDirection parameter.

Why prioritize this

Despite requiring authentication, this vulnerability merits urgent patching because ATS systems store highly sensitive personal and business data. The HIGH CVSS score reflects the broad impact scope and high confidentiality exposure. The time-based blind injection technique allows attackers to systematically extract data without detection. Combined with the prevalence of credential compromise in enterprise environments, this represents a material risk to data privacy and regulatory compliance.

Risk score, explained

The CVSS 3.1 score of 8.5 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low privileges/authentication (PR:L), no user interaction needed (UI:N), scope change to other systems (S:C indicating potential cross-system impact), high confidentiality impact (C:H), no integrity impact (I:N), and low availability impact (A:L). The score appropriately captures the serious data exfiltration risk despite the authentication requirement.

Frequently asked questions