GouGuOA: SQL injection in message trash endpoint via keywords parameter

Summary

GouGuOA version 6.0.5 and earlier is vulnerable to SQL injection in the /home/message/rubbish endpoint via the keywords parameter. The parameter is concatenated unescaped into a SQL query, so an attacker with a logged-in account can read database content such as administrator credentials, and can also extract data blindly using time-based techniques. The linked advisory states that the message controller is excluded from privilege checks, so any logged-in user can exploit it.

Affected

• GouGuOA 6.0.5 and earlier versions
• Any logged-in account can reach the affected endpoint (per the linked advisory)

Fixed in

Unknown. No fixed version has been confirmed by the vendor.

Workaround

• Restrict access to the GouGuOA message module by network or VPN
• Place the application behind a web application firewall; this is a general mitigation and not confirmed by the vendor
• Run the application's database account with least privileges

Exploitation

• CISA SSVC: exploitation status 'poc' (public proof of concept), automatable: yes, technical impact: total
• No evidence of active exploitation in the wild was found; KEV: No

Our recommendation

• Inventory all GouGuOA instances and their versions
• Restrict access to trusted users and networks, and review existing user accounts
• Monitor web and database logs for SQL error messages and injection patterns
• Apply the vendor fix once available and ask the vendor for a fixed release

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub advisory fangtang7/CVE GouGuOA sql.md github.com
• INCIBE-CERT early warning CVE-2026-88395 www.incibe.es
• Strix CVE-2026-88395 www.strix.ai
• GitHub jenn619/CVE issue 4 (related report) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:16.