CVE-2025-67066

CVE-2025-67066 is a SQL injection flaw (CWE-89) in oasys sysoa version 1.0, reachable through the outtype parameter of the /outaddresspaging path. Because the flaw is network-facing and requires no privileges or user interaction (CVSS 3.1 9.8: AV:N/AC:L/PR:N/UI:N), an unauthenticated remote attacker can submit crafted outtype values to inject SQL through the vulnerable parameter. Per the published description, successful exploitation can let the attacker execute arbitrary code on the affected system, in addition to the data access and tampering risks SQL injection typically carries. Any deployment running sysoa 1.0 with the /outaddresspaging endpoint reachable by untrusted users is affected. As of now there is no public proof of concept, the issue is not in CISA KEV, and EPSS estimates roughly a 0.4% probability of exploitation in the next 30 days (33rd percentile), so no confirmed in-the-wild exploitation is known.

What to do: Inventory any deployments of oasys sysoa and confirm the running version; if 1.0 is in use, restrict external network access to the /outaddresspaging endpoint and enforce strict validation or parameterization of the outtype parameter (e.g., via application changes or WAF rules) until a vendor fix is published. Review web and application logs for anomalous requests to /outaddresspaging containing SQL syntax or unusual characters in the outtype parameter, and monitor for a vendor advisory or patch. Note that no fixed version is documented in the available data, so do not assume any release is patched without vendor confirmation.