PT-2026-45191 · Opencats · Opencats

Texuguinho1234 · CVE-2026-49489 · Published 2026-05-31 · Updated 2026-05-31

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions OpenCATS versions prior to 0.9.7.5

Description An issue exists in the DataGrid component where authenticated users can extract database contents. Attackers can perform time-based blind SQL injection—a technique used to infer data by observing the time the server takes to respond to specific queries—by injecting malicious SQL via the sortDirection parameter in the 'ajax/getDataGridPager.php' endpoint.

Recommendations Update to a version newer than 0.9.7.4. As a temporary workaround, restrict or avoid using the sortDirection parameter in the 'ajax/getDataGridPager.php' endpoint.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-49489

GHSA-8MC8-5GW6-C7W4

Affected Products

Opencats

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49489.json · Exploit
• 🔥 https://exploit-db.com/exploits/52579 · Exploit
• 🔥 https://packetstorm.news/files/id/222200 · Exploit
• https://github.com/opencats/OpenCATS/security/advisories/GHSA-8mc8-5gw6-c7w4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-49489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49489 · Security Note
• https://vulncheck.com/advisories/opencats-sql-injection-in-datagrid-sortdirection-parameter · Note
• https://t.me/CVEtracker/55387 · Telegram Post
• https://twitter.com/CVEnew/status/2061216652964896834 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2061081140971163783 · Twitter Post
• https://t.me/cveNotify/165370 · Telegram Post