Blind SQL Injection Vulnerability in GOLDENHORN ONEIT

CVE-2026-18198 is a blind SQL injection vulnerability affecting the TAC Information Services GOLDENHORN ONEIT platform. The vulnerability is caused by improper neutralization of special elements within SQL commands, enabling unauthorized actors to manipulate database queries. This flaw resides in versions prior to the Göbeklitepe release. Successful exploitation allows an attacker to interact with the backend database, potentially leading to unauthorized data exfiltration, modification of application logic, or complete compromise of the database integrity. Because the vulnerability is blind in nature, attackers typically leverage time-based or boolean-based inference techniques to extract data, making the activity subtle and difficult to detect without specialized web application firewall or database auditing logs.

Impact

The vulnerability carries a CVSS v3.1 base score of 8.8, indicating a high level of risk to confidentiality and integrity. If exploited, an attacker could extract sensitive information stored in the application database or bypass authentication mechanisms. The scope of impact includes all organizations currently running versions of GOLDENHORN ONEIT earlier than the Göbeklitepe release.

Recommendation

Prioritized actions for security teams:

• Patch immediately by upgrading all instances of GOLDENHORN ONEIT to the Göbeklitepe release or later.
• Review web server access logs for anomalous SQL syntax, such as sleep functions, binary operators, or unexpected union statements, directed at the GOLDENHORN ONEIT application.
• Implement strict input validation and parameterized queries at the application level to mitigate against SQL injection vectors.
• Deploy WAF rules configured to detect and block common SQL injection patterns (e.g., OR 1=1, UNION SELECT, WAITFOR DELAY) targeting application endpoints.