External risk intelligence

OpenCode USSD Gateway SQL Injection in Session ID

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-65236

The vulnerability resides in a control panel endpoint of a USSD gateway. USSD gateways are typically deployed as network-facing infrastructure to handle mobile communication traffic, and control panels for such appliances are commonly accessible over the network to authorized administrators, placing this endpoint in a likely internet-facing or edge-service position.

SQL Injection

Opencode Ussd Gateway

6.13.11

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical SQL injection vulnerability discovered in OpenCode Systems' USSD Gateway software. The flaw allows unauthenticated attackers to inject malicious SQL code through the Session ID parameter, potentially leading to unauthorized access, modification, or deletion of sensitive data.

Malicious code injection into the gateway.
Critical flaw may allow data compromise.
Confirm if your USSD gateway is affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the USSD Gateway's control panel. This request targets the Session ID parameter within the `/occontrolpanel/index.php` endpoint, which is accessible over the network without any authentication. Successful exploitation could allow an attacker to manipulate the database, leading to severe data compromise, unauthorized modifications, or denial of service.

Network access required.
SQL injection via Session ID parameter.
Full database compromise possible.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the USSD Gateway's control panel could allow an unauthenticated attacker to manipulate the application's database. This could occur when the Session ID parameter in the `/occontrolpanel/index.php` endpoint is not properly sanitized, potentially leading to unauthorized access or modification of system data.

Sensitive database information.
Unsanitized Session ID parameter.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpenCode Systems USSD Gateway OC Release: 5 contains a critical SQL injection vulnerability in its control panel. This impacts application owners responsible for the USSD Gateway and potentially infrastructure or platform teams if it's part of a larger service. The immediate first step is to locate all instances of the affected USSD Gateway, determine their network exposure and business criticality, and identify the accountable owner for remediation planning.

Application or infrastructure owners.
Verify network exposure and criticality.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the OpenCode USSD Gateway?

OpenCode USSD Gateway is specialized infrastructure used by telecommunications providers to manage and process Unstructured Supplementary Service Data (USSD) messages. These messages are the text-based protocols mobile devices use to interact with carrier services, such as checking balances or accessing account menus. The gateway serves as the intermediary that translates these mobile requests so the service provider's backend systems can interpret and respond to them.

What does SQL injection mean for CVE-2025-65236?

This vulnerability is a SQL injection flaw (CWE-89). It occurs when the software does not properly sanitize input provided to the Session ID parameter. Because the application fails to distinguish between data and database commands, an attacker can input malicious SQL queries. These queries are then executed by the system's database, potentially allowing unauthorized viewing, alteration, or deletion of sensitive stored information.

How is this SQL injection triggered?

An attacker triggers this bug by sending a specially crafted request to the /occontrolpanel/index.php endpoint. The vulnerability specifically targets the Session ID parameter. Note that the system does not require authentication to process this request, meaning an attacker does not need legitimate login credentials to reach the vulnerable code path and execute their malicious SQL commands.

Is my USSD Gateway deployment at risk?

According to Halo Surface Signal, this gateway is often deployed as network-facing infrastructure. Because the vulnerable control panel endpoint is designed to be accessible over the network for administrative tasks, it frequently resides in an internet-facing or edge-service position. If your instance is reachable from the public internet, it faces a higher probability of being targeted by unauthorized actors.

How should I respond to CVE-2025-65236?

Your first step is to perform an inventory to locate all instances of the OpenCode USSD Gateway within your environment. Once identified, evaluate the network connectivity of each instance to determine if the control panel is exposed to the internet. Coordinate with the relevant application or infrastructure owners to document these systems and begin planning necessary remediation steps to secure the affected endpoints.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.