External risk intelligence

SQL Injection in oa_system oasys allDirector Method

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-44033

The product is an office automation (OA) system, which is a type of web application frequently deployed as an internet-facing portal or remote access service for employee use. Due to its role as a centralized web-based management and collaboration platform, it is commonly exposed to the public internet in many deployment scenarios.

SQL Injection

Aaluoxiang Oa System

1.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in an office automation system, specifically impacting the `oa_system` product. The flaw allows unauthorized remote access, potentially leading to the execution of malicious code within the system. The primary concern is to determine if this specific technology is in use and, if so, to what extent it is exposed.

Remote attackers can run malicious code.
Confirm if this specific software is in use.
Understand potential system compromise risks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request over the network to a vulnerable instance of oa_system. The allDirector() method in AddressMapper.java is susceptible to SQL injection, allowing an unauthenticated remote attacker to potentially execute arbitrary code.

Requires no authentication.
Triggered via a specific method call.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code by exploiting a SQL injection vulnerability in the `allDirector()` method of the `oa_system` application. This could potentially lead to unauthorized access and modification of system data when the application is exposed to the network without proper authentication.

System data and service behavior at risk.
Via network access to the `allDirector()` method.
Arbitrary code execution and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the `oa_system oasys` product likely affects application owners and infrastructure teams responsible for its deployment and maintenance. The first critical step is to identify all instances of the affected system, determine its business criticality and external reachability, and then locate the accountable owner to plan remediation.

Identify affected systems and owners.
Verify business criticality and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is oa_system oasys?

The oa_system oasys is an office automation (OA) software platform designed to centralize management and collaboration tasks. Organizations typically deploy this web-based application to facilitate internal employee workflows and handle administrative processes.

What does CVE-2025-44033 mean?

This vulnerability is classified as a SQL Injection (CWE-89). It occurs when software improperly processes input, allowing an attacker to interfere with the database queries the application makes. In this specific case, it allows an unauthenticated remote party to execute arbitrary code on the underlying system.

How is the allDirector() method triggered?

An attacker triggers the vulnerability by sending a specially crafted network request to the affected application that invokes the allDirector() method within the AddressMapper.java component. The bug does not require any prior authentication, but it must be directed at an instance where this specific method is reachable.

Is my instance of oa_system at risk?

According to Halo Surface Signal, this software is frequently deployed as an internet-facing portal to support remote work, which significantly increases the likelihood that an instance is accessible to attackers. You should consider any installation that is reachable over the public internet to be at high risk.

How do I respond to this vulnerability?

Start by identifying all instances of oa_system within your environment and mapping them to their respective business owners. Evaluate whether these systems are exposed to the internet and assess the data they handle. Once identified, work with the relevant teams to plan remediation for the vulnerable components.

References

github.com/qkdjksfkeg/Security-Collections/blob/main/sqlinjectio…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.