A SQL Injection flaw in the outtype parameter of the /outaddresspaging endpoint allows an attacker to inject malicious SQL statements that are executed by the database. This vulnerability can be used to run arbitrary code on the affected system, compromising the confidentiality and integrity of stored data while providing a foothold for further lateral movement. The weakness is an instance of fail‑to‑sanitize input for database queries (CWE‑89).

The affected product is oasys sysoa version 1.0, which exposes the /outaddresspaging path that accepts an outtype query string.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS score of <1% indicates a low current exploitation probability, and it is not listed in CISA’s KEV catalog. The likely attack vector is remote; an attacker can trigger the flaw by sending an HTTP request with a crafted outtype parameter to the publicly reachable /outaddresspaging endpoint. Because the flaw can lead to arbitrary code execution, the risk level remains high, but the low EPSS suggests limited observed exploitation to date.