SQL Injection in OpenCATS DataGrid Filter Handling

OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable restrictions by manipulating filter requests to execute arbitrary SQL queries against the database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

OpenCATS versions 0.9.1a and later contain a critical SQL injection vulnerability in the DataGrid filter mechanism that allows authenticated attackers to execute arbitrary SQL queries. The flaw exists in how the application handles filter requests on the Candidates DataGrid, specifically permitting injection through the Tags column despite restrictions designed to prevent filtering on that field. This vulnerability affects organizations using OpenCATS for applicant tracking and candidate management, potentially exposing sensitive recruitment data, personal information, and enabling unauthorized database access. With a CVSS score of 8.1, this represents a high-severity risk that requires immediate patching, particularly for instances accessible to multiple users or integrated with other HR systems.

Casky's 301 mapped security skills leverage Claude's extended reasoning to detect exploitation attempts associated with MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via network traffic analysis). Practitioners using Casky would identify suspicious DataGrid filter requests containing SQL metacharacters, abnormal query patterns targeting the Tags column field, and database activities deviating from typical candidate search operations. The platform's skill set enables detection of CWE-89 injection signatures including UNION SELECT statements, time-based blind SQL techniques, and attempts to bypass column filterable restrictions through malformed filter payloads. Security teams would observe indicators such as encoded SQL syntax in filter parameters, multiple failed filter attempts followed by successful exploitation, and unusual database query volumes—all flagged as potential TA0001/TA0043 reconnaissance or data exfiltration activities requiring immediate investigation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-49490.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-49490

Casky has 301 skills that investigate the attack patterns behind CVE-2026-49490. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn