CVE-2025-1958 is a medium severity SQL injection flaw (6.3) in aaluoxiang oa_system 1.0, in the outtype input of src/main/resources/mappers/address-mapper.xml. The record names no fixed release, so confirm with the vendor, rewrite the query with bound parameters, and restrict access to the page.
What's affected
The CVE record lists aaluoxiang oa_system, version 1.0. The weakness is classed as CWE-74, CWE-89. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reads as reachable over the network, low attack complexity, a low privilege account required and no user interaction. Impact is rated low for confidentiality, low for integrity and low for availability. The vector shows a signed in account is needed first.
The description says the exploit has been disclosed to the public and may be used. The record is not on the CISA Known Exploited Vulnerabilities list, and nothing I fetched says it is being exploited in the wild.
Fixed versions: none are named in the record. I could not confirm a vendor patch, so check the vendor's download page and the public report before assuming a newer release exists. Treat every copy of version 1.0 as exposed until you have changed the query yourself or upgraded to a release the vendor confirms.
How to check if you're exposed
Start with an inventory. Find every copy of the application on your servers, including old test installs and backups that still answer web requests.
find /var/www -name "address-mapper.xml" 2>/dev/null
grep -n "outtype" /var/www/path/to/address-mapper.xml
Open the match and look at how the value reaches the database. If the request value is joined into the SQL string, the code is vulnerable. If it is passed as a bound parameter to a prepared statement, that line is not the problem.
Then read your web server logs for requests to that path from addresses you do not recognize, and look for long values or unusual quote characters in that parameter.
grep "address-mapper.xml" /var/log/apache2/access.log | less
Finally, confirm the version against the one in your download or documentation. If you cannot tell which version you run, assume version 1.0.
What to do now
- Find every deployment of oa_system and note its version.
- If the app does not need to be public, take it offline or put it behind a VPN or an IP allowlist today.
- Rewrite the vulnerable query in src/main/resources/mappers/address-mapper.xml to use prepared statements with bound parameters, using mysqli or PDO in PHP or the equivalent in your stack. Apply the same change to every other query in the file.
- Require a valid session at the top of any admin page and check the user role before the query runs.
- Give the database account used by the app only the rights it needs, so a flaw cannot drop tables or read unrelated schemas.
- Check the vendor page for an updated release and read its notes before you upgrade.
- Review logs for the period since the version went live, and rotate any passwords stored in the affected database if you find signs of misuse.
Why it matters
SQL injection happens when user input is placed into a database query as text instead of as a value. The database then cannot tell the developer's instructions from the visitor's input. It sits under CWE-74 and the broader injection family, a long-standing and well documented weakness class.
This is a Java project and the flaw sits in a mapper XML file, not in a PHP page. If the mapper is MyBatis, a placeholder written with a dollar sign pastes the value into the SQL text, while one written with a hash sign binds it. A Java reviewer should look for that difference.
Small PHP and Java applications are often copied, customized and left running for years without updates. That is why the fix is rarely a patch you install. It is usually a code change you make yourself, and the same pattern often exists in other files of the same project.
Try it yourself
A code scan reads source files the way a reviewer would and flags queries built from request values. See how that looks on a sample project.
Click through it at your own pace, or open it full screen.
Quick check
How do I find this kind of flaw in a mapper file?
Search the mapper XML for dollar brace placeholders and replace them with hash brace placeholders where the value is data. Where a column or sort order must vary, map user choices to a fixed allowlist in code.
Is there an official patch I can install?
The record does not name a fixed version, and I could not confirm one. Check the vendor's page. Until then, the safe path is to change the query to use bound parameters and limit who can reach the page.
Sources
- CVE-2025-1958 on Safeguard Gold
- The public report and listings linked from the CVE record (record references: reference 1)
Last reviewed: 19 October 2026.
