OpenCATS up through version 0.9.7.4 contains a SQL injection flaw in the sortDirection parameter of its DataGrid component. An attacker who is already authenticated can supply malicious SQL code through the ajax/getDataGridPager.php endpoint, enabling blind, time‑based injection that can extract sensitive database contents. The weakness, identified as CWE‑89, directly compromises data confidentiality but does not provide immediate code execution or DoS capabilities.

The vulnerability affects all installations of the OpenCATS Portfolio of candidates, materially impacting any OpenCATS instance whose database holds sensitive campaign, applicant, or customer data, including versions up to and including 0.9.7.4.

With a CVSS score of 8.4, the flaw is deemed high severity. Exploitation requires legitimate user credentials, so attackers must bypass or obtain authentication before abusing the injection point. The EPSS score is currently not available, and the vulnerability is not catalogued in the CISA KEV list, but the high CVSS and authentication requirement still represent a significant risk of unintentional data exposure in environments where credentials are compromised or where user accounts have broader privileges.