A critical SQL injection vulnerability in Oasys OA System version 1.1 allows authenticated remote attackers to achieve arbitrary code execution.

This is a SQL injection vulnerability located within the alph parameter of the AddrController (src/main/Java/cn/gson/oasys/controller/address/AddrController). The vulnerability requires low-level user authentication to trigger, resulting in potential arbitrary code execution.

The ability to execute arbitrary code via SQL injection poses a severe threat to the confidentiality, integrity, and availability of the organization. Given the CVSS score of 8.0, this vulnerability could lead to a complete compromise of the underlying database and host server, potentially resulting in unauthorized data exfiltration or total system takeover.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected controller and implement strict input validation on the alph parameter.

Proactive Monitoring: Monitor database query logs for unusual syntax or unexpected administrative commands originating from the AddrController endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the identified parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher write-up referenced in the CVE record.

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate defensive action. Administrators must prioritize isolating the affected Oasys OA System components from untrusted networks until a vendor-supplied security patch is released and verified.