Unrestricted SQL Execution in OpenKM Administrative Interface

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

OpenKM 6.3.12 contains a critical SQL injection vulnerability in its administrative DatabaseQuery interface that allows authenticated admins to execute arbitrary SQL commands directly against the application database. While this requires administrative credentials, the impact is severe: attackers can extract sensitive data from the OKM_USER table (including usernames and password hashes), modify permission structures, or delete critical database records. Organizations running OpenKM 6.3.12 with administrative interfaces exposed or with compromised admin accounts face immediate risk of data breach, privilege escalation, and persistent access through modified database records.

Casky's 301 mapped security skills use Claude's extended reasoning to identify attack patterns associated with TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques by analyzing SQL query execution logs, database access patterns, and administrative interface activity. Practitioners using Casky would see detection signals when monitoring for: suspicious SQL statements in application logs containing UNION, SELECT, or DROP commands submitted through the /admin/DatabaseQuery endpoint; unusual database query execution from administrative accounts outside normal business patterns; and access to sensitive tables like OKM_USER that deviate from expected administrative workflows. The platform's CWE-89 (SQL Injection) skill mapping helps teams correlate malicious input patterns in the qs parameter with known exploitation signatures, enabling rapid identification of reconnaissance activity probing database schema or initial access attempts by compromised administrators.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-42425.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-42425

Casky has 301 skills that investigate the attack patterns behind CVE-2026-42425. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn