VULNARCHIVE

GCVE-1988-2026-0430

[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)

Description (en)

0day Rubbish Research Team is publicly disclosing a vulnerability in Logo
Netsis NetOpenX REST 2.0.6.9 (also distributed as Netsis Nox REST), the REST
API gateway of the Netsis enterprise ERP suite.

Type: unauthenticated SQL injection in the OAuth 2.0 token endpoint leading to
operating-system command execution via SQL Server xp_cmdshell
(CWE-89, CWE-306, CWE-78). A single POST /api/v2/token carrying no client and
no user credentials supplies a form field named idmuserid that is concatenated
raw into a SQL statement by ServiceManager.GetIdmUserLastSessionInfo, issued
before OAuthManager.LogIn actually validates the credentials. The backend is
SQL Server, so a semicolon yields a stacked batch that enables xp_cmdshell and
then runs an OS command.

Scoring. This finding is dual-scored, with the stricter readings published
alongside the headline rather than in a footnote, each against its own vector:
- PRIMARY, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This is
  the recorded headline figure and it describes only the elevation tier, that is
  the configuration where the service's SQL login holds sysadmin, as it did in
  the verified environment. It is not a claim that command execution is available
  on every deployment.
- CONDITIONAL, 8.1 High, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The same
  impact set under a stricter attack-complexity judgement that treats the sysadmin
  property of the service login, a deployment characteristic outside the
  attacker's control, as a condition of command execution.
- CONDITIONAL lower bound, 7.5 High, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
  Where the service login is not sysadmin, the same request still yields
  unauthenticated blind SQL injection with data disclosure but no OS access.

Impact: at the elevation tier, OS command execution on the ERP database host with
the identity of the SQL Server service account (NT AUTHORITY\SYSTEM in the
verified configuration), meaning control of the ERP financial and accounting
database, exfiltration of it, and a pivot into the internal network. The
injection is blind at the HTTP layer.

Authentication: unauthenticated. The pipeline registers no global authorization
filter, the token endpoint is an OWIN middleware route on which action filters
never apply, and the shipped SQL fragment blacklist is inert.

Verification boundary, stated plainly. This was NOT verified against a stock
installed product reached across a network. A complete Netsis ERP deployment was
not achievable in the lab, so the chain was driven against a reconstruction of
the product pipeline (the real OWIN Startup, OAuthConfig, WebApiConfig and
authorization-server provider, hosted via WebApp.Start on loopback
127.0.0.1:8977, against a real SQL Server Express instance whose NETSIS login
held sysadmin), with exactly one method body, ServiceManager.GetConnectionString,
rewritten by a Mono.Cecil IL patch to clear a commercial licensing gate that is
not a security boundary. The sink, the authentication logic, the routing table,
the OAuth provider and the SQL concatenation were all left as unmodified product
code. Because the reconstruction's listener was bound to loopback, remote network
exposure is a code and deployment argument rather than an observed remote run.

Full technical analysis and a reproducible proof-of-concept:
  https://0day-rubbish.com/blog/netsis-netopenx-unauth-sqli-xp-cmdshell-rce

Project archive (ongoing disclosure series):
  https://github.com/Exploit-Garbage/0day-Rubbish

The vendor has been notified through its published security contact. No vulnerability identifier has been assigned to
this finding yet.

--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Netsis NetOpenX REST",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Logo\nNetsis NetOpenX REST 2.0.6.9 (also distributed as Netsis Nox REST), the REST\nAPI gateway of the Netsis enterprise ERP suite.\n\nType: unauthenticated SQL injection in the OAuth 2.0 token endpoint leading to\noperating-system command execution via SQL Server xp_cmdshell\n(CWE-89, CWE-306, CWE-78). A single POST /api/v2/token carrying no client and\nno user credentials supplies a form field named idmuserid that is concatenated\nraw into a SQL statement by ServiceManager.GetIdmUserLastSessionInfo, issued\nbefore OAuthManager.LogIn actually validates the credentials. The backend is\nSQL Server, so a semicolon yields a stacked batch that enables xp_cmdshell and\nthen runs an OS command.\n\nScoring. This finding is dual-scored, with the stricter readings published\nalongside the headline rather than in a footnote, each against its own vector:\n- PRIMARY, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This is\n  the recorded headline figure and it describes only the elevation tier, that is\n  the configuration where the service's SQL login holds sysadmin, as it did in\n  the verified environment. It is not a claim that command execution is available\n  on every deployment.\n- CONDITIONAL, 8.1 High, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The same\n  impact set under a stricter attack-complexity judgement that treats the sysadmin\n  property of the service login, a deployment characteristic outside the\n  attacker's control, as a condition of command execution.\n- CONDITIONAL lower bound, 7.5 High, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.\n  Where the service login is not sysadmin, the same request still yields\n  unauthenticated blind SQL injection with data disclosure but no OS access.\n\nImpact: at the elevation tier, OS command execution on the ERP database host with\nthe identity of the SQL Server service account (NT AUTHORITY\\SYSTEM in the\nverified configuration), meaning control of the ERP financial and accounting\ndatabase, exfiltration of it, and a pivot into the internal network. The\ninjection is blind at the HTTP layer.\n\nAuthentication: unauthenticated. The pipeline registers no global authorization\nfilter, the token endpoint is an OWIN middleware route on which action filters\nnever apply, and the shipped SQL fragment blacklist is inert.\n\nVerification boundary, stated plainly. This was NOT verified against a stock\ninstalled product reached across a network. A complete Netsis ERP deployment was\nnot achievable in the lab, so the chain was driven against a reconstruction of\nthe product pipeline (the real OWIN Startup, OAuthConfig, WebApiConfig and\nauthorization-server provider, hosted via WebApp.Start on loopback\n127.0.0.1:8977, against a real SQL Server Express instance whose NETSIS login\nheld sysadmin), with exactly one method body, ServiceManager.GetConnectionString,\nrewritten by a Mono.Cecil IL patch to clear a commercial licensing gate that is\nnot a security boundary. The sink, the authentication logic, the routing table,\nthe OAuth provider and the SQL concatenation were all left as unmodified product\ncode. Because the reconstruction's listener was bound to loopback, remote network\nexposure is a code and deployment argument rather than an observed remote run.\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/netsis-netopenx-unauth-sqli-xp-cmdshell-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/78"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/78"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/netsis-netopenx-unauth-sqli-xp-cmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/78"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0430",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/78",
            "automated": true,
            "contentSha256": "8321527b821733ff4ab9e302f47421f65ae35b1178b3187a83472f43f952a147",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/78",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T04:55:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0430"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}