CVE-2026-88395

Summary

GouGuOA v6.0.5 and earlier versions are vulnerable to SQL Injection through the keywords parameter in the /home/message/rubbish endpoint, allowing attackers to execute arbitrary SQL commands and potentially gain full control over the database.

Exploitability

Exploitation is relatively straightforward as the flaw can be triggered via a crafted input to the keywords parameter. Precondition is that the application is running and accessible over the network.

Blast radius

If exploited, the impact could be severe, as it allows full control over the database, potentially leading to data theft, corruption, or denial of service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GouGuOA v6.0.6 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.