An unauthenticated SQL injection vulnerability in Meneame English Pligg 5.8 allows remote attackers to extract sensitive database information, posing a high risk to data confidentiality.

The application is vulnerable to SQL injection via the search parameter in index.php. An unauthenticated attacker can send crafted GET requests containing malicious SQL payloads to extract database contents, including usernames and version details.

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, which may lead to the exfiltration of sensitive information. Given the CVSS score of 8.2, this flaw is considered high severity, as it facilitates direct interaction with the backend database without requiring authentication, potentially resulting in full compromise of application data.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the affected web application or disable the search functionality until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting index.php with suspicious strings, such as SELECT, UNION, or OR 1=1 patterns, which are indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in URL parameters to mitigate the risk of exploitation.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 45875.

Due to the high severity of this SQL injection vulnerability and the availability of public proof-of-concept code, immediate action is required to prevent unauthorized data access. If the application cannot be patched or the search function disabled, implement strict ingress filtering and WAF protections to shield the vulnerable parameter from external exploitation attempts.