Introduction
A critical flaw in OPEXUS FOIAXpress Public Access Link (PAL) prior to version 11.13.1.0 can let attackers expose or destroy sensitive government records and FOIA request data. The SQL injection vulnerability, CVE-2025-58462, allows remote, unauthenticated attackers to manipulate the backend database through the SearchPopularDocs.aspx endpoint. It carries a CVSS score of 9.8.
About OPEXUS FOIAXpress and PAL: OPEXUS is a US-based government contractor. Federal, state, and local agencies use its FOIAXpress suite to manage Freedom of Information Act (FOIA) requests. The Public Access Link (PAL) is the web-facing portal where the public submits FOIA requests and searches documents, which makes it a critical part of how agencies handle transparency and compliance. The platform is widely deployed across US government agencies and handles high volumes of sensitive requests and records.
Technical Information
CVE-2025-58462 is a SQL injection vulnerability in the SearchPopularDocs.aspx endpoint of FOIAXpress PAL. The root cause is insufficient input validation combined with the absence of parameterized queries. User-supplied input is concatenated directly into SQL statements, so attackers can inject arbitrary SQL code by sending crafted requests to the vulnerable endpoint.
The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The endpoint requires no authentication, so any remote attacker can target it. It is believed to handle search queries for public documents, which makes it a frequent target and raises the risk of exploitation.
Technical impact:
- Attackers can read, modify, or delete any data in the backend database.
- Exploitation requires no authentication, so any external user can carry it out.
- The PAL portal is public-facing, which exposes the attack surface to the internet.
The referenced sources contain no public code snippets or exploit payloads. The cause is confirmed as improper input handling in the affected endpoint.
Affected Systems and Versions
- Product: OPEXUS FOIAXpress Public Access Link (PAL)
- Affected versions: All versions prior to 11.13.1.0
- Vulnerable endpoint: SearchPopularDocs.aspx
- The vulnerability exists in default configurations of affected versions
Vendor Security History
OPEXUS has fixed multiple security issues in FOIAXpress before, including SQL injection vulnerabilities in version 11.4.0 (see release notes). In February 2025, a major insider breach led to the deletion of 33 federal databases and the theft of sensitive files, and it exposed gaps in hiring and access control. The vendor documents security fixes in its release notes and has a history of responding to vulnerabilities. Recent events, though, point to ongoing problems with security governance and operational controls.
