Skip to Content (Press Enter)
How is your experience with the OutSystems Community?
UserImage.jpg
Ajay Shrivastava
11Views
2Comments
[SQL Sandbox] Regarding SQL sandbox vulnerability and alternatives in Outsystems 11 (Reactive)
Question
Forge
sql-sandbox
Web icon
SQL Sandbox (O11)
Forge asset by Leonardo Fernandes

Hi Everyone,

Greetings for the day!!!

I am using SQL Sandbox as a data query tool for maintenance, issue investigation and testing and support purposes. With the recent discovery of most significant vulnerabilities found in PHP (i.e., CVE-2026-109618 and CVE-2026-109619), I am having below queries:

- Is SQL Sandbox having any dependency of PHP 

- Is SQL sandbox having any impact due to these recently reported issues.

- SQL Sandbox is developed based on what technology?

- How secure is SQL sandbox for day-to-day DB access for maintenance and troubleshooting purposes?

- is there any other alternative tool for SQL Sandbox to access the data trough back end?


Thanks in advance,

Regards,

Ajay Shrivastava

0
0
25 Oct
Copy Link
2026-07-23 14-34-51
Nuno Reis
 
MVP

Hello.

1, 2, and 3 - OutSystems runs on .NET so most forge components are done in either OutSystems or .NET.  Any exception will need some pre installations and you simply can't install PHP in a Personal Environment so that is not an issue.

4 and 5 - "Use it at your own risk" any database manipulation tool is dangerous, this one is the oldest, most used, and supported by great people. I wouldn't use any other unless you develop it yourself.

0
0
25 Oct
Copy Link
UserImage.jpg
Niteesh yadav

Hi,

  1. PHP dependency: No. SQL Sandbox is an OutSystems Forge component, and OutSystems runs on .NET/Java, not PHP.
  2. Impact of the CVEs: None, since PHP isn’t used anywhere in SQL Sandbox or the OutSystems runtime as far as i concern.
  3. Technology: It is built on OutSystems 11 (Traditional Web).
  4. Security: It is safe if access is controlled. Only users with the DML role can open it, but it runs SQL directly on the platform DB, so use it carefully, especially for INSERT, UPDATE and DELETE. Keep it disabled in production and enable it only when needed. It is also a community component, not officially supported by OutSystems.
  5. Alternatives: Connect to the DB directly with SSMS or SQL Developer using a read-only account. 

Regards,

0
0
26 Oct
Copy Link
Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.