OPEXUS FOIAXpress PAL SQL injection

The SQL Injection vulnerability in FOIAXpress PAL poses a significant risk to organizations utilizing this software. An attacker exploiting this flaw can bypass authentication and directly interact with the database. This allows for unauthorized access to sensitive data, including personally identifiable information (PII), confidential documents, and system configuration details. The attacker could also modify or delete data, leading to data loss and disruption of services. The lack of authentication requirements amplifies the risk, as any external user can attempt exploitation. Successful exploitation could result in a complete compromise of the system and its data, similar to scenarios where database credentials are leaked or improperly configured.

Organizations utilizing FOIAXpress PAL for public document access are at risk, particularly those with older, unpatched installations. Shared hosting environments where multiple users share the same database instance are especially vulnerable, as a compromise of one user's account could lead to a broader data breach. Organizations relying on FOIAXpress PAL for sensitive data management should prioritize patching.

• linux / server: Monitor access logs for requests to SearchPopularDocs.aspx containing unusual characters or SQL keywords (e.g., UNION, SELECT, INSERT, DELETE).

grep -i 'UNION|SELECT|INSERT|DELETE' /var/log/apache2/access.log | grep SearchPopularDocs.aspx

• generic web: Use curl to test the SearchPopularDocs.aspx endpoint with various SQL injection payloads to observe the application's response.

curl 'http://your-foiaxpress-server/SearchPopularDocs.aspx?q=1+UNION+SELECT+@@version' -v

• database (mysql): If database access is possible, check for unusual database entries or modifications that could indicate exploitation.

SELECT * FROM users WHERE username LIKE '%malicious%';

1. 2025-09-09Disclosure

   disclosure

1. 已保留2025-09-02
2. 发布日期2025-09-09
3. 修改日期2026-02-26
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-58462 is to immediately upgrade FOIAXpress PAL to version 11.13.1.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the SearchPopularDocs.aspx endpoint using a Web Application Firewall (WAF) or proxy server, implementing strict input validation rules to filter out potentially malicious SQL queries. Regularly review database access logs for suspicious activity and implement strong database security practices, including least privilege access controls. Consider implementing a Content Security Policy (CSP) to restrict the resources that the application can load, further limiting the potential impact of a successful SQL injection attack.