An SQL injection vulnerability in Galaxy Forces MMORPG version 0.5.8 allows authenticated attackers to execute arbitrary database queries and exfiltrate sensitive system information.

The application is vulnerable to SQL injection (CWE-89) within the ads.php script. Authenticated attackers can supply malicious SQL payloads through the type parameter in POST requests to bypass data filtering and access unauthorized database content.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to database contents, including usernames and system configuration details. Given the CVSS score of 7.1, this flaw poses a significant risk to data confidentiality and integrity, potentially leading to full administrative compromise of the underlying database.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected ads.php endpoint to trusted users only or disable the vulnerable module if it is not essential for operations.

Proactive Monitoring: Security teams should audit web server access logs for anomalous POST requests containing SQL keywords or unusual characters in the type parameter of the ads.php script.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns targeting the ads.php script.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up on Exploit-DB (EDB-ID: 45864).

Given the availability of a public exploit, this vulnerability presents a credible risk to the confidentiality of the database. Organizations currently running Galaxy Forces MMORPG 0.5.8 must implement strict access controls and WAF filtering immediately until a vendor-supplied security update is released.