OpenCATS through version 0.9.7.4 contains a SQL injection vulnerability in the sortDirection parameter of the DataGrid component. The vulnerability exists in the ajax/getDataGridPager.php file and allows authenticated users to extract database contents. Attackers can exploit this flaw by injecting malicious SQL code via the sortDirection parameter to perform time-based blind injection attacks. This enables unauthorized access to sensitive data stored in the database. The vulnerability affects all versions of OpenCATS up to and including 0.9.7.4.