External risk intelligence

OpenCode USSD Gateway SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-65235

The vulnerable product is a USSD Gateway, which by design acts as a network edge service for telecommunications infrastructure. Such gateways are intended to process external requests and provide an interface between mobile networks and service applications, making them inherently public-facing or externally reachable in standard operational deployments.

SQL Injection

Opencode Ussd Gateway

6.13.11

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A SQL injection vulnerability has been identified in the OpenCode Systems USSD Gateway. This type of flaw allows unauthorized access and manipulation of underlying data by attackers who can insert malicious SQL code into queries. Given the gateway's role in telecommunications infrastructure, this vulnerability could have significant implications for data integrity and service availability if exploited.

A system flaw allows data access through the gateway.
External access could compromise sensitive information.
Confirm relevance and exposure of this system.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the USSD Gateway. This request would target the `getSubUsersByProvider` function, manipulating the `ID` parameter. Successful exploitation could allow an attacker to access, modify, or delete sensitive data stored in the system's database.

No authentication or user interaction required.
Triggered via a manipulated ID parameter.
Allows unauthorized database access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to manipulate queries to the USSD Gateway's database when the `getSubUsersByProvider` function is called with a crafted `ID` parameter. This manipulation could lead to unauthorized access or modification of sensitive data stored within the system, affecting service integrity.

Sensitive system data could be exposed.
Remote unauthenticated access to query parameters.
Compromise of database integrity and confidentiality.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpenCode Systems USSD Gateway is a network-facing component, and the SQL injection vulnerability within the `getSubUsersByProvider` function presents a critical risk due to its potential for complete system compromise. Identifying all instances of this gateway, confirming their exposure and business criticality, and locating the accountable owners are the immediate priorities. Remediation planning should then be prioritized based on these findings, involving coordination with vendor-management and security teams.

Ownership: Application and platform teams.
Verify: Gateway exposure and business criticality.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the OpenCode USSD Gateway?

The OpenCode USSD Gateway is a telecommunications software component that bridges mobile networks and service applications. It facilitates Unstructured Supplementary Service Data (USSD) messaging, which is commonly used for mobile service interactions like checking account balances or interacting with menu-based mobile services.

What does SQL injection mean for CVE-2025-65235?

This CVE involves a vulnerability class known as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain English, the software fails to properly filter input, allowing an attacker to inject their own database commands. By manipulating the 'ID' parameter, an unauthorized user can trick the gateway into running unintended queries that expose, change, or delete database information.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted request to the gateway that interacts with the 'getSubUsersByProvider' function. Notably, this does not require any prior authentication or special user interaction to initiate. Simply providing malicious input within the 'ID' parameter of that specific function call is sufficient to bypass intended security controls.

Do I need to worry about this vulnerability?

If you operate this software, you should be concerned. Halo Surface Signal notes that USSD Gateways act as network edge services, meaning they are designed to process external requests from mobile networks. Because this function is inherently positioned to face external traffic, it is highly likely that your instance is reachable by remote, unauthenticated attackers.

When should I take action for CVE-2025-65235?

You should act immediately by identifying all active instances of the OpenCode USSD Gateway within your infrastructure. Once located, verify the exposure level and business criticality of each instance. Coordinate with your security and platform teams to establish ownership and prioritize remediation planning to protect your database integrity from unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.