External risk intelligence

GouGuOA SQL Injection Vulnerability in Message Rubbish Component

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-88395

The vulnerability affects GouGuOA, which is an enterprise collaborative office automation system. Such applications are typically deployed as internet-facing web portals to facilitate remote access for employees, making the web interface and its parameters commonly reachable from the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical security vulnerability found in GouGuOA, an office automation system, specifically affecting versions prior to 6.0.5. The issue allows for unauthorized manipulation of databases through the system's messaging feature, potentially leading to significant data compromise.

Database code flaws in office system.
Critical flaw could impact data integrity.
Verify exposure; prepare for remediation.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the affected system's message feature. This could involve submitting a request to the `rubbish` endpoint, potentially containing malicious input in the `keywords` parameter. Successful exploitation could allow an attacker to manipulate the database, leading to unauthorized access or modification of sensitive information.

No authentication or special privileges required.
SQL injection via the `keywords` parameter.
Leads to unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL commands into the system via the keywords parameter when processing messages. This could potentially lead to unauthorized access, modification, or deletion of sensitive data managed by the GouGuOA system.

System database.
Via a network request with crafted input.
Compromise of sensitive business data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical SQL injection vulnerability in GouGuOA affects the keywords parameter within the /home/message/rubbish endpoint. Application owners and infrastructure teams are likely responsible for addressing this, with initial steps involving locating all instances of the affected software, confirming external reachability and business criticality, and identifying the specific asset owners. The process should then involve risk-based remediation planning, potentially coordinating with vendor management if applicable, and scheduling maintenance windows for fixes or implementing temporary mitigation strategies.

Verify GouGuOA deployment and external reachability.
Confirm asset ownership and business criticality.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GouGuOA?

GouGuOA is an enterprise collaborative office automation system designed to streamline internal business communications and document management. Organizations typically deploy this platform as a centralized web portal to help staff coordinate tasks and manage organizational data efficiently.

What does SQL Injection mean for CVE-2026-88395?

This vulnerability is classified as CWE-89, which occurs when an application improperly filters user input before sending it to the backend database. In this case, it allows an attacker to inject and execute their own unauthorized commands, potentially bypassing security controls to read, alter, or delete sensitive records held by the system.

How is this GouGuOA vulnerability triggered?

An attacker triggers this flaw by sending a network request to the /home/message/rubbish endpoint with a malicious payload inside the keywords parameter. The vulnerability specifically requires this crafted input to be processed; it is not triggered by simply navigating to the application or interacting with standard, non-malicious features.

Who is most at risk from this vulnerability?

Organizations running GouGuOA are at higher risk if their instances are reachable from the public internet. According to Halo Surface Signal, because this system is often deployed as a web portal for remote employee access, it is frequently exposed, which may allow unauthenticated attackers to interact with the vulnerable parameter remotely.

How should I respond if I use GouGuOA?

Begin by identifying all internal installations of GouGuOA to determine which systems are affected. Prioritize those that are accessible via the internet, confirm who owns the software within your organization, and plan a maintenance window to apply necessary updates or implement temporary mitigations to secure the messaging feature.

References

github.com/fangtang7/CVE/blob/main/GouGuOA/sql.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.