An unauthenticated SQL injection vulnerability in Warranty Tracking System 11.06.3 poses a severe risk of unauthorized database information disclosure.

The application is vulnerable to SQL injection via the txtCustomerCode, txtCustomerName, and txtPhone POST parameters in the SearchCustomer.php script. This flaw allows an unauthenticated attacker to manipulate database queries to extract sensitive information, such as usernames and database structure.

The exploitation of this vulnerability can lead to the full exposure of backend database contents, which may include sensitive customer data, system credentials, and internal configuration details. Given the CVSS score of 8.2, this is a high-severity issue that could result in significant data breaches, compliance violations, and severe reputational damage to the organization.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected script or implement input validation routines to sanitize POST parameters.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous POST requests to SearchCustomer.php, particularly those containing SQL syntax or keywords like UNION, SELECT, or OR.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable parameters.

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit Database (EDB-ID: 45881).

This vulnerability presents a high risk of unauthorized data exposure due to the simplicity of the attack vector. Organizations using version 11.06.3 of the Warranty Tracking System should prioritize the implementation of compensating controls, such as WAF filtering, to block malicious requests until a vendor-supplied update is available.