An unauthenticated SQL injection vulnerability in EdTv 2 allows remote attackers to execute arbitrary database queries and extract sensitive information from the underlying database.

This is an SQL injection vulnerability located in the admin/edit_source endpoint. An unauthenticated attacker can supply a crafted SQL UNION statement via the 'id' parameter to bypass security controls and retrieve database schema, user credentials, and version information.

The ability for an unauthenticated attacker to extract database contents poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to the exposure of user credentials, sensitive configuration data, and system information, which may be leveraged for further unauthorized access or total system compromise. This vulnerability carries a high severity rating (CVSS 8.2), reflecting the ease of exploitation and the potential for significant data loss.

Immediate Action: As no official vendor patch is currently confirmed, administrators should immediately restrict network access to the admin/edit_source endpoint to trusted IP addresses only.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous GET requests containing SQL syntax or UNION statements directed toward the admin/edit_source path.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the 'id' parameter in administrative endpoints.

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID: 45849).

Given the availability of a public proof of concept and the critical nature of SQL injection flaws, this vulnerability presents a significant risk to the affected environment. Organizations running EdTv 2 must prioritize the implementation of compensating controls, such as WAF rules or network segmentation, to mitigate this exposure until a permanent fix is available. Immediate action is required to prevent unauthorized data extraction.