Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Netsis NetOpenX REST",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Logo\nNetsis NetOpenX REST 2.0.6.9 (also distributed as Netsis Nox REST), the REST\nAPI gateway of the Netsis enterprise ERP suite.\n\nType: unauthenticated SQL injection in the OAuth 2.0 token endpoint leading to\noperating-system command execution via SQL Server xp_cmdshell\n(CWE-89, CWE-306, CWE-78). A single POST /api/v2/token carrying no client and\nno user credentials supplies a form field named idmuserid that is concatenated\nraw into a SQL statement by ServiceManager.GetIdmUserLastSessionInfo, issued\nbefore OAuthManager.LogIn actually validates the credentials. The backend is\nSQL Server, so a semicolon yields a stacked batch that enables xp_cmdshell and\nthen runs an OS command.\n\nScoring. This finding is dual-scored, with the stricter readings published\nalongside the headline rather than in a footnote, each against its own vector:\n- PRIMARY, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This is\n  the recorded headline figure and it describes only the elevation tier, that is\n  the configuration where the service\u0027s SQL login holds sysadmin, as it did in\n  the verified environment. It is not a claim that command execution is available\n  on every deployment.\n- CONDITIONAL, 8.1 High, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The same\n  impact set under a stricter attack-complexity judgement that treats the sysadmin\n  property of the service login, a deployment characteristic outside the\n  attacker\u0027s control, as a condition of command execution.\n- CONDITIONAL lower bound, 7.5 High, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.\n  Where the service login is not sysadmin, the same request still yields\n  unauthenticated blind SQL injection with data disclosure but no OS access.\n\nImpact: at the elevation tier, OS command execution on the ERP database host with\nthe identity of the SQL Server service account (NT AUTHORITY\\SYSTEM in the\nverified configuration), meaning control of the ERP financial and accounting\ndatabase, exfiltration of it, and a pivot into the internal network. The\ninjection is blind at the HTTP layer.\n\nAuthentication: unauthenticated. The pipeline registers no global authorization\nfilter, the token endpoint is an OWIN middleware route on which action filters\nnever apply, and the shipped SQL fragment blacklist is inert.\n\nVerification boundary, stated plainly. This was NOT verified against a stock\ninstalled product reached across a network. A complete Netsis ERP deployment was\nnot achievable in the lab, so the chain was driven against a reconstruction of\nthe product pipeline (the real OWIN Startup, OAuthConfig, WebApiConfig and\nauthorization-server provider, hosted via WebApp.Start on loopback\n127.0.0.1:8977, against a real SQL Server Express instance whose NETSIS login\nheld sysadmin), with exactly one method body, ServiceManager.GetConnectionString,\nrewritten by a Mono.Cecil IL patch to clear a commercial licensing gate that is\nnot a security boundary. The sink, the authentication logic, the routing table,\nthe OAuth provider and the SQL concatenation were all left as unmodified product\ncode. Because the reconstruction\u0027s listener was bound to loopback, remote network\nexposure is a code and deployment argument rather than an observed remote run.\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/netsis-netopenx-unauth-sqli-xp-cmdshell-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/78"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/78"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/netsis-netopenx-unauth-sqli-xp-cmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/78"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0430",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/78",
            "automated": true,
            "contentSha256": "8321527b821733ff4ab9e302f47421f65ae35b1178b3187a83472f43f952a147",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/78",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T04:55:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0430"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}