Description

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.14.12, 3.15.12, 3.16.6 and 3.17-beta2 is sufficient to fix this issue. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-16T02:16:48.790Z",
  "pubdate": "2026-08-16T02:16:48.790Z",
  "executiveSummary": "A critical security vulnerability has been identified in the open-ils.fielder OpenSRF Service of Evergreen, specifically within the endpoint handlers interacting with /osrf-gateway-v1. Classified as a SQL injection (SQLi) vulnerability, this flaw allows remote, unauthenticated attackers to manipulate database queries by supplying maliciously crafted input to vulnerable functions. Successful exploitation of this vulnerability can lead to unauthorized data access, potential data exfiltration, database manipulation, and compromise of the underlying database management system supporting the Evergreen ILS infrastructure. The risk implication is severe, as the exploit has been publicly disclosed and is viable for remote exploitation across network perimeters. Systems affected include Evergreen versions up to 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. Remediation requires an immediate upgrade to the patched versions provided by the vendor.",
  "technicalDetails": "The vulnerability resides in the open-ils.fielder OpenSRF Service component of Evergreen, specifically within the request handling logic accessible via the /osrf-gateway-v1 interface. The root cause stems from improper input sanitization and a lack of parameterized queries or adequate escaping mechanisms within an unknown function handling database search parameters or field filters. When untrusted user input is passed through the OpenSRF gateway to the open-ils.fielder service, the input is improperly concatenated or dynamically interpolated directly into SQL statements executed against the backend database.\nThe attack flow begins with a remote adversary crafting a malicious HTTP payload directed at the /osrf-gateway-v1 endpoint. This payload encapsulates specially formatted OpenSRF protocol messages designed to invoke the vulnerable function within the open-ils.fielder service. Embedded within the function arguments are SQL injection payloads, such as SQL union statements, tautologies, or stacked queries.\nUpon receiving the request, the open-ils.fielder service processes the input without sufficient validation, allowing the malicious SQL syntax to merge with the application's internal query structure. The backend database server then executes the resulting modified query under the application's database privileges. Depending on the injected statements, the payload behavior can range from extracting sensitive database contents—such as patron records, staff credentials, and system configurations—to modifying or deleting data within the database tables.\nThe vulnerability is exposed remotely over the network, requiring no prior authentication or specific user privileges to initiate the attack vector. The combination of network accessibility, lack of authentication controls, and direct database interaction heightens the severity of the flaw, enabling automated or manual exploitation by external threat actors."
}