{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "other",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      },
      {
        "category": "summary",
        "text": "Successful exploitation could allow a remote, unauthenticated attacker to read, write, or delete any content in the underlying database.",
        "title": "Risk Evaluation"
      },
      {
        "category": "general",
        "text": "Upgrade to FOIAXpress PAL version 11.13.1.0.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-25-252-01 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-252-01.json"
      }
    ],
    "title": "OPEXUS FOIAXpress Public Access Link (PAL) SQL injection",
    "tracking": {
      "current_release_date": "2025-09-09T20:48:26Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.10.0"
        }
      },
      "id": "VA-25-252-01",
      "initial_release_date": "2025-09-09T20:48:26Z",
      "revision_history": [
        {
          "date": "2025-09-09T20:48:26Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c11.13.1.0",
                "product": {
                  "name": "OPEXUS FOIAXpress Public Access Link (PAL) \u003c11.13.1.0",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "11.13.1.0",
                "product": {
                  "name": "OPEXUS FOIAXpress Public Access Link (PAL) 11.13.1.0",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "FOIAXpress Public Access Link (PAL)"
          }
        ],
        "category": "vendor",
        "name": "OPEXUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-58462",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:Y/T:T/2025-09-09T16:22:24Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Release Notes v11.13.1.0",
          "url": "https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.1.0.pdf"
        },
        {
          "category": "external",
          "summary": "CVE-2025-58462",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58462"
        },
        {
          "category": "external",
          "summary": "VA-25-252-01 CSAF",
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/IT/white/2025/va-25-252-01.json"
        }
      ],
      "release_date": "2025-08-01T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-01T00:00:00Z",
          "details": "Fixed in version 11.13.1.0.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.1.0.pdf"
        },
        {
          "category": "vendor_fix",
          "date": "2025-08-01T00:00:00Z",
          "details": "Fixed in version 11.13.1.0.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.1.0.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "OPEXUS FOIAXpress PAL SQL injection"
    }
  ]
}