OpenCATS, the open-source applicant tracking system, has a SQL injection vulnerability in versions up to 0.9.7.4. An authenticated attacker can extract the entire database — including usernames, password hashes, and access levels — through a blind time-based technique.
The flaw is in the ajax.php endpoint, specifically the getDataGridPager function. The sortDirection parameter gets passed into a SQL query without proper sanitization. By injecting a conditional SLEEP() statement, an attacker can extract data one character at a time based on response delays.
It’s not the most efficient attack — each character requires multiple requests — but it works. The exploit script confirms the vulnerability by comparing baseline response times against sleep-injected queries, then systematically dumps the database version, name, user table contents, and password hashes.
What you need to know: the attacker must first log in with valid credentials. So this isn’t something a random internet stranger can exploit without an account. But for organizations running OpenCATS with low-privilege user accounts, the risk is real.
The advisory is tracked as GHSA-8mc8-5gw6-c7w4. No CVE has been assigned yet.
