[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-27 04:12 UTC
Importiert: 2026-09-27 05:30 UTC
Quelle-ID: full_disc
uid_hash: afaf4e59c25e9e2b9b33bad8b1626cc57aae71084fd9e0714c3c2c7c70f97ed2

Full Disclosure

Posted by disclosure via Fulldisclosure on Sep 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Logo

Netsis NetOpenX REST 2.0.6.9 (also distributed as Netsis Nox REST), the REST

API gateway of the Netsis enterprise ERP suite.

Type: unauthenticated SQL injection in the OAuth 2.0 token endpoint leading to

operating-system command execution via SQL Server xp_cmdshell

(CWE-89, CWE-306, CWE-78). A single POST /api/v2/token carrying no client and

no user credentials supplies a...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss