Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)

Full Disclosure ()4 · 1 read
Read at seclists.org
Part of a story covered by 5 sourcesFive command-injection flaws disclosed in network and enterprise gearMerged summary & timeline
AI summary · grok-4.7Summaries by Vani AI

Logo Netsis NetOpenX REST 2.0.6.9 allows unauthenticated SQL injection that can run commands as SYSTEM.

0day Rubbish Research Team disclosed a flaw in Logo Netsis NetOpenX REST 2.0.6.9, the REST API gateway for the Netsis enterprise ERP suite. An unauthenticated SQL injection in the OAuth 2.0 token endpoint can lead to operating-system command execution through SQL Server xp_cmdshell. The issue is scored 9.8 and mapped to CWE-89, CWE-306, and CWE-78. The post cites no CVE and does not report exploitation in the wild.

Key facts
  • Affects Logo Netsis NetOpenX REST 2.0.6.9, also called Netsis Nox REST.
  • Unauthenticated SQL injection in the OAuth 2.0 token endpoint.
  • Injection can reach SQL Server xp_cmdshell and run commands as SYSTEM.
  • Scored 9.8 and mapped to CWE-89, CWE-306, and CWE-78.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
netsissql-injectionrcexp-cmdshellerplogooauth
Vendors
Logo
Products
Netsis NetOpenX RESTNetsis
Organizations
0day Rubbish Research Team

From the original article

Posted by disclosure via Fulldisclosure on Sep 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Logo Netsis NetOpenX REST 2. 0. 6.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.